I'm having problem on the eval part on join subsearch. When i run this search, I've got this result
"Error in 'eval' command: The expression is malformed. Expected )."
I'm using Dropdown on the dashboard as my timepicker so i have multiple tokens. Thanks
...//my base search//... earliest=$_emon$/$_eday$/$_eyear$:00:00:00 latest=$_lmon$/$_lday$/$_lyear$:23:59:59
| join type=outer
[
search ...//another base search//... latest="+2mon" earliest=[| gentimes start=-1|eval new = relative_time($_emon$/$_eday$/$_eyear$:00:00:00 ,"-2228000")| return $new]
But when I'm using default time picker and use only one token $time.earliest$, my search is okay. Is the issue on this was having multiple tokens when selecting time? Thanks
Hi, @iancorrea
Let's check how to use the relative_time function.
You must specify UNIX time in the first argument.
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/DateandTimeFunctions
For the problem you are facing, converting to UNIX time with strptime function first will give you the expected result.
ex)
| eval etime = strptime("$_emon$/$_eday$/$_eyear$:00:00:00", "%m/%d/%Y:%H:%M:%S")
| eval new = relative_time(etime,"-2228000")
Hi, @iancorrea
Let's check how to use the relative_time function.
You must specify UNIX time in the first argument.
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/DateandTimeFunctions
For the problem you are facing, converting to UNIX time with strptime function first will give you the expected result.
ex)
| eval etime = strptime("$_emon$/$_eday$/$_eyear$:00:00:00", "%m/%d/%Y:%H:%M:%S")
| eval new = relative_time(etime,"-2228000")
Thanks! This works the way I want it. 😄