Hello there!
I'm trying to use <change> and <eval> inside of my time input to create a token that takes in $time.earliest$ and converts it to a unix timestamp, however, my <eval> is not working how I expect.
When I use $start_time$ in my dashboard panels, I get a literal copy/paste of the "relative_time(now() ..." statement (i.e., it's not actually evaluating). I've seen multiple examples in Splunk documentation and it seems like <eval> is supposed to evaluate the function you're trying to use.
Help me, Splunk Community. You're my only hope.
There doesn't appear to be anything wrong with what you are doing (apart from I don't think you need the quotes around the token in the relative_time function, and the condition is probably superfluous); the issue may be to do with the version of Splunk you are using as there have been issues with this before iirc. Which version are you using?
I'm on Splunk Cloud version 9.0.2305.201.
Don't I need the quotes in the relative_time function? If $time.earliest$ is a relative time modifier (e.g., -7d@h), it needs quotes, right?
I am using enterprise and it works without quotes with -7d@h