set earliest from string

[kennethyeung]

i have a dashboard, in the click.value will have a string value (e.g 20182010)
and then below have another line chart, but how can i put the token to that search

e.g
index=test earliest=$token_date$

i think the $token_date need to use strptime to convert and then pass to search. but how?
Thanks

[sashraf]

Instead of having earliest=$token_date$ in your search, replace it with the following subsearch:

[| makeresults | eval thisdate="$token_date$" | eval earliest=strptime(thisdate, "%Y%d%m") | fields + earliest]

So your example search would instead look like this:

index=test [| makeresults | eval thisdate="$token_date$" | eval earliest=strptime(thisdate, "%Y%d%m") | fields + earliest]

This is all assuming the date format you have is YYYYDDMM which would translate to 20th October 2018 with your example of 20182010. If the date format will be YYYYMMDD then use this instead:

index=test [| makeresults | eval thisdate="$token_date$" | eval earliest=strptime(thisdate, "%Y%m%d") | fields + earliest]

[niketn]

Is it is table or chart that you are clicking to get 20182010 as click.value?

[kamlesh_vaghela]

hi @kennethyeung,

You can use strptime when you click on chart and set token_date. what is date format of 20182010?
Can you please share you sample dashboard xml?

[kennethyeung]

Thanks your suggestion, i should eval token instead of eval in the search
strftime(strptime($click.value$,"%Y%m%d"),"%m/%d/%Y:00:00:00")
and the in search

index=$tok_index$ earliest="$tok_date$"

[kamlesh_vaghela]

So, have you resolved your issue?