Getting Data In

Time format

Vigneshprasanna
Explorer

Hi Mates,

i get output of a query as below, i would like to pass the output of this query to the of my code but the is not supporting the time format generated by the query so please help in changing the time format

output = AUDIT_TIME="2018-06-05 21:00:02"

Query :

index="jboss" AUDIT_DATA="XXXXX" AND AUDIT_DATA=""XXXX8"" AUDIT_TIME>="2018-06-05 21:00:00" | table AUDIT_TIME | sort AUDIT_TIME | uniq | sort 2 AUDIT_TIME | reverse | return AUDIT_TIME

i wanna pass this output value AUDIT_TIME in

alt text

0 Karma

Vigneshprasanna
Explorer

Hi @PowerPacked and @sukisen1981

I'm going wrong somewhere 😞 can you please check and correct me i have modified the query and tried for my case but its not working 😞

this is my sample data
2018-05-14 14:25:00,108 INFO com.xxxxxxx.browser.servlets.BrowserServlet 123-132-0-23-0

2018-05-14 14:25:00 -> i wanna pass this part as the input for the tag $earliest$

alt text

   <earliest>$earliest$</earliest>
0 Karma

PowerPacked
Builder

Hi @Vigneshprasanna

use this query to extract the time from result.

index="jboss" AUDIT_DATA="XXXXX" AND AUDIT_DATA=""XXXX8"" AUDIT_TIME>="2018-06-05 21:00:00" | table AUDIT_TIME | sort AUDIT_TIME | uniq | sort 2 AUDIT_TIME | reverse | return AUDIT_TIME | rex "AUDIT_TIME=\"(?P<time>.*)\"" | fields time

Thanks

0 Karma

Sukisen1981
Champion

pass audit time in where? do you mean you want to extract / sort by audit time?

0 Karma

Vigneshprasanna
Explorer

Hi @sukisen1981

i wanna pass the AUDIT_TIME in

Jboss Drilldown

<panel>
  <table>
    <title>Dynamic drilldown Jboss Request/Response</title>
    <search>
      <query>  **Query that will return AUDIT_TIME** </query>
      **<earliest>$earliest$</earliest>**   - **should pass the audit time here** 
      <latest>$latest$</latest>
      </search>
       </table>
</panel>

This is jest an example snippit may have some more errors too hope this helps us to understand where we have to pass the AUDIT_TIME..

Thanks for the support in advance.

Regards,
Vigneshprasanna R

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...