eval to make a copy like this:
... | eval jobEarliestTime = $job.earliestTime$ | eval jobLatestTime = $job.latestTime$ ...
Hello @woodcock, you are a wonderful Splunker. I wanna thank you for all efforts you are providing here.
Regarding the $job.latestTime$ token , in case if you are choosing the preset time "All Time" from the Time Picker, the value is of the token will be null or "NaN".
So how to add a condition using eval if to force it to be eqal to now() in such case?
Time ranges(Settings » User interface » Time ranges):
Name Label Order Earliest time Latest time Owner all_time All time 500 0 No owner
No this solution doesn't work.
I solved storing my date list in an index instead of a lookup: in this way each item has an own timestamp and I can use them.
Not sure if this matches to you use case here, but Splunk 6.3 introduces search event handlers to access job metadata that might get you close to what you are looking for.
From a search and simple xml standpoint, it looks like this:
<search> <query>index=foo bar</query> <earliest>-60m@m</earliest> <latest>now</latest> <progress> <set token="myEarliest">$job.earliestTyime$</set> <set token="myLatest">$job.latestTyime$</set> </progress> <search>
The above simple xml snippet grabs the job earliestTime/latestTime, and sets tokens based on them, making these tokens available throughout the page.
And how is it possible to change the format of these two variables:
let's suppose $job.earliestime$ shows 2015-11-03T00:00:00.000+01:00
What if I needed to see only the date and no time zone (not the part T00:00:00.000+01:00)?
Is it possible?
I was wondering if you had any response regarding how to change the format of those 2 variables: $job.earliestime$$joblatestime$