Getting Data In

Convert Time Picker values in readable format..?

vinothn
Path Finder

Based on the time picker & time modifier token i am displaying the time values in a human readable format in a label.

For this command i am getting the proper results.alt text

| makeresults
| eval latest1="1583038799.000",earliest1="1567310400.000"
| eval latest2=strftime(latest1,"%Y-%m-%d %H:%M:%S"),earliest2=strftime(earliest1,"%Y-%m-%d %H:%M:%S")

But if i try it in time modifier i am not getting the same result i am not sure it is because of time zone ..?

![<search>
    <query>
      |makeresults 
| addinfo
    </query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    <done>
      <eval token="Tearliest">strftime($result.info_min_time$,"%Y-%m-%d %H:%M:%S")</eval>
      <eval token="Tlatest">strftime($result.info_max_time$,"%Y-%m-%d %H:%M:%S")</eval>
    </done>
  </search>][2]

Both the places i am using the same code getting different results. any thoughts..
Thanks in advance....

0 Karma
1 Solution

manjunathmeti
SplunkTrust
SplunkTrust

Hi @vinothn,

There is an exception while using eval expression with function strftime() to define token filtering for dashboards. It uses client (browser) time zone. It will be better if you convert epoch to date time string search query itself then set fields to token.

![<search>
     <query>
       |makeresults 
       | addinfo | eval info_min_datetime=strftime(info_min_time,"%Y-%m-%d %H:%M:%S %Z"), info_max_datetime=strftime(info_max_time,"%Y-%m-%d %H:%M:%S %Z")
     </query>
     <earliest>$field1.earliest$</earliest>
     <latest>$field1.latest$</latest>
     <done>
       <set token="Tearliest">$result.info_min_datetime$</set>
       <set token="Tlatest">$result.info_max_datetime$</set>
     </done>
   </search>][2]

View solution in original post

vinothn
Path Finder

Thank you @manjunathmeti the above answer is working.
Still since my splunk instance is running on EST it is showing time stamp values in EST zone, but the users are from different zone is there any way to show the timestamp based on the user location.

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @vinothn,

You can eval expression like one in your question only.

![<search>
     <query>
       |makeresults 
 | addinfo
     </query>
     <earliest>$field1.earliest$</earliest>
     <latest>$field1.latest$</latest>
     <done>
       <eval token="Tearliest">strftime($result.info_min_time$,"%Y-%m-%d %H:%M:%S %z")</eval>
       <eval token="Tlatest">strftime($result.info_max_time$,"%Y-%m-%d %H:%M:%S %z")</eval>
     </done>
   </search>][2]

manjunathmeti
SplunkTrust
SplunkTrust

Hi @vinothn,

There is an exception while using eval expression with function strftime() to define token filtering for dashboards. It uses client (browser) time zone. It will be better if you convert epoch to date time string search query itself then set fields to token.

![<search>
     <query>
       |makeresults 
       | addinfo | eval info_min_datetime=strftime(info_min_time,"%Y-%m-%d %H:%M:%S %Z"), info_max_datetime=strftime(info_max_time,"%Y-%m-%d %H:%M:%S %Z")
     </query>
     <earliest>$field1.earliest$</earliest>
     <latest>$field1.latest$</latest>
     <done>
       <set token="Tearliest">$result.info_min_datetime$</set>
       <set token="Tlatest">$result.info_max_datetime$</set>
     </done>
   </search>][2]
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...