Extract Time Picker text generated by Splunk Enterprise into a token for use in a report

[drtwite]

I am trying to set a token ($TimeFrame$) to contain the same text as displayed by the Time Frame filter after having selected any particular time picker range – in this case “Last 13 Days” selected from  Relative section of the Time Picker – but any time picker range or preset text being displayed in the Time Frame filter must work - see diagram below.

I would like to extract exactly the same text that Splunk>Enterprise puts in the filter display box and assign it to my token $TimeFrame$.

I can only find solutions that work in a limited number of cases because it involves trying to convert the formatted earliest and latest tokens  back into text, for example, the code below works some of the time, but not for “Last 13 Days”, and is very messy having to deal with with special cases individually, for example  “All Time”:

        <eval token="picktime">"From ".strftime($field1.earliest$,"%H:%M %e-%b-%Y")." to ".strftime($field1.latest$,"%H:%M %e-%b-%Y")</eval>

        <eval token="TimeFrame">if($picktime$ == "From 01:00 1-Jan-1970 to 01:00 1-Jan-1970" OR $picktime$ == "From 00:00 1-Jan-1970 to 00:00 1-Jan-1970","All time",$picktime$)</eval>

Anyone know of a better way of doing this?
Mike

[ITWhisperer]

You could look at this solution

https://community.splunk.com/t5/Dashboards-Visualizations/What-s-the-Token-name-for-the-Time-Picker-...

[drtwite]

I have coded a work around for this now - see snippet below.
It duplicates the text produced by Splunk in the Time Range filter for most Preset values, and for date ranges defaults to a To.... From.... format that is suitable for printed reports (where the filters are not included in the report). Let me know if you find any problems with the code. DrTwite.



<input type="time" token="field1">
<label>Time Frame</label>
<change> <!-- On change in time picker - update appropriate Earliest/Latest time variables -->
<condition match="($mode$=&quot;Real&quot; AND $initialise$=&quot;done&quot;)">
<set token="realEarliestTime">$form.field1.earliest$</set>
<set token="realLatestTime">$form.field1.latest$</set>

<set token="fe">$form.field1.earliest$</set> <!-- This block of 8 lines decodes the Time Modifier coming out of the Time Picker into readable text in variable TimeFrame, eg. -24h decodes to "Last 24 hours". Real Mode & Sample mode versions are identicle. -->
<set token="fl">$form.field1.latest$</set>
<eval token="suf">substr(ltrim(replace(replace(replace(fe,"mon","M"),"w1","W"),"w0","w"),"-0123456789rt@"),1,1)</eval>
<eval token="suf">if(suf == "y"," year",if(suf == "q"," quarter",if(suf == "m"," minute",if(suf == "M"," month",if(suf == "s"," second",if(suf == "h"," hour",if(suf == "d"," day",if(suf == "w"," week",if(suf == "W"," business week","-")))))))))</eval>
<eval token="fe">if(fe == "@d","Today",if(fe == "-1d@d","Yesterday",if(fe == "-7d@w0","Previous week",if(fe == "-6d@w1","Previous business week",if(fe == "-1mon@mon","Previous month",if(substr(fe,1,3) == "rt-",substr(rtrim(fe,$alpha$),4).suf." window",fe))))))</eval>
<eval token="fe">if(fe == "-1y@y","Previous year",if(substr(fe,1,1) == "-","Last ".substr(rtrim(fe,$alpha$),2).suf."s",if(substr(fe,1,1) == "@",upper(substr(suf,2,1)).substr(suf,3)." to date",fe)))</eval>
<eval token="fe">if(suf.fe.fl == "-0","All time",if(suf.fe.fl == "-rtrt","All time (real time)",if(suf.fe == "-0","Before ".strftime(fl,"%H:%M %e-%b-%Y"),if(suf.fl == "-now","Since ".strftime(fe,"%H:%M %e-%b-%Y"),if(suf == "-","*",fe)))))</eval>
<eval token="form.TimeFrame">if(suf.fe == "-*","From ".strftime($form.field1.earliest$,"%H:%M %e-%b-%Y")." to ".strftime($form.field1.latest$,"%H:%M %e-%b-%Y"),fe)</eval>
</condition>

<condition match="$mode$=&quot;Sample&quot;">
<set token="sampleEarliestTime">$form.field1.earliest$</set>
<set token="sampleLatestTime">$form.field1.latest$</set>

<set token="fe">$form.field1.earliest$</set> <!-- This block of 8 lines decodes the Time Modifier coming out of the Time Picker into readable text in variable TimeFrame, eg. -24h decodes to "Last 24 hours". Real Mode & Sample mode versions are identicle. -->
<set token="fl">$form.field1.latest$</set>
<eval token="suf">substr(ltrim(replace(replace(replace(fe,"mon","M"),"w1","W"),"w0","w"),"-0123456789rt@"),1,1)</eval>
<eval token="suf">if(suf == "y"," year",if(suf == "q"," quarter",if(suf == "m"," minute",if(suf == "M"," month",if(suf == "s"," second",if(suf == "h"," hour",if(suf == "d"," day",if(suf == "w"," week",if(suf == "W"," business week","-")))))))))</eval>
<eval token="fe">if(fe == "@d","Today",if(fe == "-1d@d","Yesterday",if(fe == "-7d@w0","Previous week",if(fe == "-6d@w1","Previous business week",if(fe == "-1mon@mon","Previous month",if(substr(fe,1,3) == "rt-",substr(rtrim(fe,$alpha$),4).suf." window",fe))))))</eval>
<eval token="fe">if(fe == "-1y@y","Previous year",if(substr(fe,1,1) == "-","Last ".substr(rtrim(fe,$alpha$),2).suf."s",if(substr(fe,1,1) == "@",upper(substr(suf,2,1)).substr(suf,3)." to date",fe)))</eval>
<eval token="fe">if(suf.fe.fl == "-0","All time",if(suf.fe.fl == "-rtrt","All time (real time)",if(suf.fe == "-0","Before ".strftime(fl,"%H:%M %e-%b-%Y"),if(suf.fl == "-now","Since ".strftime(fe,"%H:%M %e-%b-%Y"),if(suf == "-","*",fe)))))</eval>
<eval token="form.TimeFrame">if(suf.fe == "-*","From ".strftime($form.field1.earliest$,"%H:%M %e-%b-%Y")." to ".strftime($form.field1.latest$,"%H:%M %e-%b-%Y"),fe)</eval>
</condition>

<condition match="$initialise$=&quot;start&quot;">
<set token="form.field1.earliest">$realEarliestTime$</set>
<set token="form.field1.latest">$realLatestTime$</set>
<set token="form.TimeFrame">$realEarliestTime$.1</set>
<set token="initialise">done</set>
</condition>
</change>
</input>  

[drtwite]

Hi ITWhisperer
Thanks for your reply - I have had a look at the solution that you refer to, the principle it is basically the same as my existing code - endeavouring to reconstruct the displayed text from the earliest and latest token values that only works in certain cases.
Ideally Splunk should provide a token that contains a direct copy of the text being used in the Time Picker label itself if there isn't one already?
Mike