From Element that will accept a single datettime v...

Ashwin3 · ‎07-17-2022

Is there a form element that accepts only a single datetime value?

User will be entering two fields, field 1 as a single datetime and field 2 as a duration like "1h".

Based on this two inputs, need to calculate and set time values as below

For eg:

User input field 1[TimeTokenMid] --> 07/12/2022:18:00:00

User input field 2[Duration] --> "1h"

Need to calculate and set time ranges as below using relative_time function.

Token_1 = 07/12/2022:17:00:00 [TimeTokenMid - Duration using relative_time fnc]

Token_2 = 07/12/2022:19:00:00 [TimeTokenMid + Duration using relative_time fnc]

Currently i am taking field 1[TimeTokenMid] as text and doing calculation as the current timepicker control is not allowing to set a single custom time value. It has options only for selecting a range like (last 60 mins, between x and y etc)like that. In my usecase,I want to take a single timevalue input and calculate time ranges(+-) based on the duration input dynamically. Could you please suggest any solution?

yuanliu · ‎07-17-2022

One way is to use <eval token /> under <progress /> with a fake search, as inspired by .

For example,

<form>
  <label>Set time window</label>
  <search>
    <query>
      | makeresults
    </query>
    <progress>
      <condition match="true()">
        <eval token="latest_tok">strftime(relative_time(strptime($Token_1$, "%m/%d/%Y:%H:%M:%S"), "+" . $Token_2$), "%m/%d/%Y:%H:%M:%S")</eval>
      </condition>
    </progress>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="Token_1" searchWhenChanged="true">
      <label>start time</label>
      <choice value="07/12/2022:17:00:00">07/12/2022:17:00:00</choice>
      <choice value="07/13/2022:17:00:00">07/13/2022:17:00:00</choice>
      <choice value="07/14/2022:17:00:00">07/14/2022:17:00:00</choice>
      <initialValue>07/12/2022:17:00:00</initialValue>
    </input>
    <input type="dropdown" token="Token_2" searchWhenChanged="true">
      <label>interval</label>
      <choice value="2h">2h</choice>
      <choice value="4h">4h</choice>
      <choice value="8h">8h</choice>
      <choice value="12h">12h</choice>
      <default>2h</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>latest token: $latest_tok$</div>
      </html>
    </panel>
  </row>
</form>

Is there a Form Element that will accept a single datetime value?

single value

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Join the Conversation