Issue on Dropdown timepicker on Dashboard

[iancorrea]

I'm having problem on the eval part on join subsearch. When i run this search, I've got this result

"Error in 'eval' command: The expression is malformed. Expected )."

I'm using Dropdown on the dashboard as my timepicker so i have multiple tokens. Thanks

...//my base search//... earliest=$_emon$/$_eday$/$_eyear$:00:00:00 latest=$_lmon$/$_lday$/$_lyear$:23:59:59 

| join type=outer
        [
            search ...//another base search//... latest="+2mon" earliest=[| gentimes start=-1|eval new = relative_time($_emon$/$_eday$/$_eyear$:00:00:00 ,"-2228000")| return $new]

But when I'm using default time picker and use only one token $time.earliest$, my search is okay. Is the issue on this was having multiple tokens when selecting time? Thanks

[elle118 · Accepted solution]

Hi, @iancorrea

Let's check how to use the relative_time function.
You must specify UNIX time in the first argument.

https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/DateandTimeFunctions

For the problem you are facing, converting to UNIX time with strptime function first will give you the expected result.

ex)

| eval etime = strptime("$_emon$/$_eday$/$_eyear$:00:00:00", "%m/%d/%Y:%H:%M:%S")
| eval new = relative_time(etime,"-2228000")

[iancorrea]

Thanks! This works the way I want it. 😄