Are there time parser functions that won't work in tokens set by the time input

[camillak]

I am trying to create a "between now and now string" using the following:

    <input type="time" searchWhenChanged="true">
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
      <change>
        <set token="earliestToken">$earliest$</set>
        <set token="latestToken">$latest$</set>
        <eval token="earliestEpoch">case(isnull($earliest$) OR $earliest$=0 OR $earliest$="", relative_time(now(), "-95d"), isnum($earliest$), $earliest$, $earliest$="now", now(), true(), relative_time(now(), $earliest$))</eval>
        <eval token="latestEpoch">case(isnull($latest$) OR $latest$=0 OR $latest$="", now(), isnum($latest$), $latest$, $latest$="now", now(), true(), relative_time(now(), $latest$))</eval>
        <eval token="earliestString">strftime($earliestEpoch$, "%T %x")</eval>
        <eval token="latestString">strftime($latestEpoch$, "%T %x")</eval>
      </change>
    </input>

I have tested a couple of different things and it works if I use %c or "%a %b %e, %Y" and even for just %x or %T. Is there any good reason the combination of %T %x won't work?

[niketn]

@camillak using <eval> to set token might work differently as compared to SPL eval command for relative_time, strftime() and strptime(). Refer to documentation http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Define_token_filtering_and_formatting

For setting the time-tokens in dashboard based on Time Picker input, there are two approaches:
1) Using <eval> to set tokens
2) Use addinfo command in an independent search to set the required token using <done> or <progress> search event handler.

Both the approach are explained with run anywhere example in one of my previous answers: https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html

Since you need the second approach, please refer to following sample search which displays the required output (you would need to remove the search outside of <row><panel><table> as independent search and set the required tokens using Search Event Handler as per your need.

Following is the Simple XML code for above run anywhere example:

<form>
  <label>Tokens Based on Time Picker</label>
  <fieldset>
    <input type="time" token="tokTime" searchWhenChanged="true">
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| addinfo 
| eval tokTime_earliest="$tokTime.earliest$", tokTime_latest="$tokTime.latest$" 
| eval earliestEpoch=case(isnull(info_min_time) OR info_min_time==0 OR info_min_time="", relative_time(now(), "-95d"), isnum(info_min_time), info_min_time, info_min_time=="now", now(), true(), relative_time(now(), info_min_time)),
    latestEpoch=case(isnull(info_max_time) OR info_max_time="+Infinity" OR info_max_time=="", now(), isnum(info_max_time), info_max_time, info_max_time=="now", now(), true(), relative_time(now(), info_max_time)),
    earliestString=strftime(earliestEpoch, "%T %x"),
    latestString=strftime(latestEpoch, "%T %x") 
| table tokTime_earliest info_min_time earliestEpoch earliestString tokTime_latest info_max_time latestEpoch latestString</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

[DalJeanis]

This looks like a question for our guru @niketnilay