Dashboards & Visualizations

Invalid Date using Job in the UI

sangs8788
Communicator

@niketn 

I am trying to display the selected start and end time in the UI. I followed particularly the below answer given by you. 

https://community.splunk.com/t5/Dashboards-Visualizations/Setting-job-earliestTime-and-job-latestTim...

It was working fine but suddenly it stopped saying Invalid Date. We recently had a splunk Upgrade to Version:8.0.4.1. Could it be due to the upgrade? Was there any change. I couldnt narrow down to exact issue.

Here is the code which you have shared

 

<form>
  <label>Show Time from Time Picker</label>
  <!-- Dummy search to pull selected time range earliest and latest date/time -->
  <search>
    <query>| makeresults | addinfo </query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    <done>
      <eval token="tokEarliestTime">strftime(strptime('$job.earliestTime$',"%Y/%m/%dT%H:%M:%S.%3N %p"),"%m/%d/%y %I:%M:%S.%3N %p")</eval>
      <eval token="tokLatestTime">strftime(strptime('$job.latestTime$',"%Y/%m/%dT%H:%M:%S.%3N %p"),"%m/%d/%y %I:%M:%S.%3N %p")</eval>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <!-- sample HTML Panel to display results in required format -->
      <html>
        (  $tokEarliestTime$ to $tokLatestTime$)
      </html>
    </panel>
  </row>
</form>

 

Attaching the screenshot of what is shown in the UI. Could you please suggest. 

Labels (2)
Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sangs8788 

Try this,

<form>
  <label>Show Time from Time Picker</label>
  <!-- Dummy search to pull selected time range earliest and latest date/time -->
  <search>
    <query>| makeresults | addinfo</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    <done>
      <eval token="tokEarliestTime">strftime($result.info_min_time$,"%Y/%m/%dT%H:%M:%S.%3N %p")</eval>
      <eval token="tokLatestTime">strftime($result.info_max_time$,"%Y/%m/%dT%H:%M:%S.%3N %p")</eval>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    
  </fieldset>
  <row>
    <panel>
      <!-- sample HTML Panel to display results in required format -->
      <html>
        (  $tokEarliestTime$ to $tokLatestTime$)
      </html>
    </panel>
  </row>
</form>

 

Screenshot 2021-07-19 at 5.05.52 PM.png

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sangs8788 

Try this,

<form>
  <label>Show Time from Time Picker</label>
  <!-- Dummy search to pull selected time range earliest and latest date/time -->
  <search>
    <query>| makeresults | addinfo</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    <done>
      <eval token="tokEarliestTime">strftime($result.info_min_time$,"%Y/%m/%dT%H:%M:%S.%3N %p")</eval>
      <eval token="tokLatestTime">strftime($result.info_max_time$,"%Y/%m/%dT%H:%M:%S.%3N %p")</eval>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    
  </fieldset>
  <row>
    <panel>
      <!-- sample HTML Panel to display results in required format -->
      <html>
        (  $tokEarliestTime$ to $tokLatestTime$)
      </html>
    </panel>
  </row>
</form>

 

Screenshot 2021-07-19 at 5.05.52 PM.png

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

sangs8788
Communicator

This works. Thanks for looking into this.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Hi

Replace the eval lines with this ones:

<eval token="tokEarliestTime">strftime(strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m/%d/%y %I:%M:%S.%3N %p")</eval>
<eval token="tokLatestTime">strftime(strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m/%d/%y %I:%M:%S.%3N %p")</eval>

 

Also, I'm sad to say that Niket is no longer with us. He passed away last year.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

sangs8788
Communicator

This doesnt work either

0 Karma

sangs8788
Communicator

I am so sorry hear that. I didnt know. May his soul rest in peace. Didnt expect

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...