Getting Data In

Are there time parser functions that won't work in tokens set by the time input

Path Finder

I am trying to create a "between now and now string" using the following:

    <input type="time" searchWhenChanged="true">
        <set token="earliestToken">$earliest$</set>
        <set token="latestToken">$latest$</set>
        <eval token="earliestEpoch">case(isnull($earliest$) OR $earliest$=0 OR $earliest$="", relative_time(now(), "-95d"), isnum($earliest$), $earliest$, $earliest$="now", now(), true(), relative_time(now(), $earliest$))</eval>
        <eval token="latestEpoch">case(isnull($latest$) OR $latest$=0 OR $latest$="", now(), isnum($latest$), $latest$, $latest$="now", now(), true(), relative_time(now(), $latest$))</eval>
        <eval token="earliestString">strftime($earliestEpoch$, "%T %x")</eval>
        <eval token="latestString">strftime($latestEpoch$, "%T %x")</eval>

I have tested a couple of different things and it works if I use %c or "%a %b %e, %Y" and even for just %x or %T. Is there any good reason the combination of %T %x won't work?

Tags (2)
0 Karma


@camillak using <eval> to set token might work differently as compared to SPL eval command for relative_time, strftime() and strptime(). Refer to documentation

For setting the time-tokens in dashboard based on Time Picker input, there are two approaches:
1) Using <eval> to set tokens
2) Use addinfo command in an independent search to set the required token using <done> or <progress> search event handler.

Both the approach are explained with run anywhere example in one of my previous answers:

Since you need the second approach, please refer to following sample search which displays the required output (you would need to remove the search outside of <row><panel><table> as independent search and set the required tokens using Search Event Handler as per your need.

alt text

Following is the Simple XML code for above run anywhere example:

  <label>Tokens Based on Time Picker</label>
    <input type="time" token="tokTime" searchWhenChanged="true">
          <query>| makeresults 
| addinfo 
| eval tokTime_earliest="$tokTime.earliest$", tokTime_latest="$tokTime.latest$" 
| eval earliestEpoch=case(isnull(info_min_time) OR info_min_time==0 OR info_min_time="", relative_time(now(), "-95d"), isnum(info_min_time), info_min_time, info_min_time=="now", now(), true(), relative_time(now(), info_min_time)),
    latestEpoch=case(isnull(info_max_time) OR info_max_time="+Infinity" OR info_max_time=="", now(), isnum(info_max_time), info_max_time, info_max_time=="now", now(), true(), relative_time(now(), info_max_time)),
    earliestString=strftime(earliestEpoch, "%T %x"),
    latestString=strftime(latestEpoch, "%T %x") 
| table tokTime_earliest info_min_time earliestEpoch earliestString tokTime_latest info_max_time latestEpoch latestString</query>
        <option name="refresh.display">progressbar</option>
| makeresults | eval message= "Happy Splunking!!!"
0 Karma


This looks like a question for our guru @niketnilay

0 Karma