Getting Data In

Convert Time Picker values in readable format..?

vinothn
Path Finder

Based on the time picker & time modifier token i am displaying the time values in a human readable format in a label.

For this command i am getting the proper results.alt text

| makeresults
| eval latest1="1583038799.000",earliest1="1567310400.000"
| eval latest2=strftime(latest1,"%Y-%m-%d %H:%M:%S"),earliest2=strftime(earliest1,"%Y-%m-%d %H:%M:%S")

But if i try it in time modifier i am not getting the same result i am not sure it is because of time zone ..?

![<search>
    <query>
      |makeresults 
| addinfo
    </query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    <done>
      <eval token="Tearliest">strftime($result.info_min_time$,"%Y-%m-%d %H:%M:%S")</eval>
      <eval token="Tlatest">strftime($result.info_max_time$,"%Y-%m-%d %H:%M:%S")</eval>
    </done>
  </search>][2]

Both the places i am using the same code getting different results. any thoughts..
Thanks in advance....

0 Karma
1 Solution

manjunathmeti
Champion

Hi @vinothn,

There is an exception while using eval expression with function strftime() to define token filtering for dashboards. It uses client (browser) time zone. It will be better if you convert epoch to date time string search query itself then set fields to token.

![<search>
     <query>
       |makeresults 
       | addinfo | eval info_min_datetime=strftime(info_min_time,"%Y-%m-%d %H:%M:%S %Z"), info_max_datetime=strftime(info_max_time,"%Y-%m-%d %H:%M:%S %Z")
     </query>
     <earliest>$field1.earliest$</earliest>
     <latest>$field1.latest$</latest>
     <done>
       <set token="Tearliest">$result.info_min_datetime$</set>
       <set token="Tlatest">$result.info_max_datetime$</set>
     </done>
   </search>][2]

View solution in original post

vinothn
Path Finder

Thank you @manjunathmeti the above answer is working.
Still since my splunk instance is running on EST it is showing time stamp values in EST zone, but the users are from different zone is there any way to show the timestamp based on the user location.

0 Karma

manjunathmeti
Champion

hi @vinothn,

You can eval expression like one in your question only.

![<search>
     <query>
       |makeresults 
 | addinfo
     </query>
     <earliest>$field1.earliest$</earliest>
     <latest>$field1.latest$</latest>
     <done>
       <eval token="Tearliest">strftime($result.info_min_time$,"%Y-%m-%d %H:%M:%S %z")</eval>
       <eval token="Tlatest">strftime($result.info_max_time$,"%Y-%m-%d %H:%M:%S %z")</eval>
     </done>
   </search>][2]

manjunathmeti
Champion

Hi @vinothn,

There is an exception while using eval expression with function strftime() to define token filtering for dashboards. It uses client (browser) time zone. It will be better if you convert epoch to date time string search query itself then set fields to token.

![<search>
     <query>
       |makeresults 
       | addinfo | eval info_min_datetime=strftime(info_min_time,"%Y-%m-%d %H:%M:%S %Z"), info_max_datetime=strftime(info_max_time,"%Y-%m-%d %H:%M:%S %Z")
     </query>
     <earliest>$field1.earliest$</earliest>
     <latest>$field1.latest$</latest>
     <done>
       <set token="Tearliest">$result.info_min_datetime$</set>
       <set token="Tlatest">$result.info_max_datetime$</set>
     </done>
   </search>][2]
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...