Solved: Re: strptime with time zone - eval token drilldown

gavalle · ‎10-11-2018

When evaluating this token in an "eval" drilldown:
strptime("2000-01-01 +00:00", "%F %:z")
It does not produce any result.

...But, actually, if in a standard search we write:
eval foo = strptime("2000-01-01 +00:00", "%F %:z")
It will produce "946684800" as result, which is the correct epoch we are looking for.

In the end, it looks like the command is properly written but, for some reasons, it cannot work in drilldowns.
Do you know why?

renjith_nair · ‎10-11-2018

@gavalle,

In the dashboard drilldown, its throws an error due to ":" character between % and z. Remove the colon(:) and try strptime("2000-01-01 +00:00", "%F %z") in the eval and it should work. Somehow search bar ignores this while parsing.

Below works for me

<dashboard>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults|eval time="2000-01-01 +00:00"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <eval token="NEW_TIME">strptime("2000-01-01 +00:00","%F %z")</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <html>
      <h1>$NEW_TIME$ </h1>
    </html>
  </row>
</dashboard>

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair · ‎10-11-2018

@gavalle,

In the dashboard drilldown, its throws an error due to ":" character between % and z. Remove the colon(:) and try strptime("2000-01-01 +00:00", "%F %z") in the eval and it should work. Somehow search bar ignores this while parsing.

Below works for me

<dashboard>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults|eval time="2000-01-01 +00:00"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <eval token="NEW_TIME">strptime("2000-01-01 +00:00","%F %z")</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <html>
      <h1>$NEW_TIME$ </h1>
    </html>
  </row>
</dashboard>

---
What goes around comes around. If it helps, hit it with Karma 🙂

strptime with time zone - eval token drilldown

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Join the Conversation