Dashboards & Visualizations

Why am I getting error "Invalid date" trying to set now as default value for the date time picker?

s_aria
New Member

Hi all,

I'm trying to set now value for a default setting:

    <input type="time" token="time" searchWhenChanged="true">
      <label></label>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>now</latestTime>
      </default>
      <change>
        <eval token="form.et">strftime('earliest', "%F")</eval>
        <eval token="form.lt">strftime('latest', "%F")</eval>
      </change>
    </input>

I keep getting an error when I try and run the query with default value for latest. Only in this case.

Any advice would be well received.

Thanks,
Sal

0 Karma

erwanlebaron
Engager

The issue came from the fact the format is done as "relative date".
Try to change

<eval token="form.et">strftime('earliest', "%F")</eval>

by

<eval token="form.et">strftime(relative_time(now(),'earliest'), "%F"</eval>
0 Karma

sundareshr
Legend

Should be earliest & latest

 <input type="time" token="time" searchWhenChanged="true">
       <label></label>
       <default>
         <earliest>0</earliestTime>
         <latest>now</latestTime>
       </default>
       <change>
         <eval token="form.et">strftime('earliest', "%F")</eval>
         <eval token="form.lt">strftime('latest', "%F")</eval>
       </change>
     </input>
0 Karma

s_aria
New Member

also replacing the tag name the error persist.

Thanks,
Sal

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @s.aria,
Could you try substituting "earliest" and "latest" for these two tags? For one, "earliestTime" and "latestTime" are deprecated and 'earliest'/'latest' should be used instead. I also wonder if the difference in the tag name you are using (earliestTime) and the reference you are passing to the strftime function ('earliest'), might be causing an issue.

Hope this helps! Let me know if this does not fix the problem and we can keep discussing.

0 Karma

s_aria
New Member

Hi @frobinson

Thanks for the reply.
I tried replacing the tag name, but the error persist:
form.et=1970-01-01
form.lt=Invalid date

Thanks,
Sal

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi Sal,
What search string are you using? Can you post it?

0 Karma

s_aria
New Member

Hi,

in a | dbquery ....... WHERE FIELD >= STR_TO_DATE('$form.lt$','%Y-%m-%d')

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...