Time format

[Vigneshprasanna]

Hi Mates,

i get output of a query as below, i would like to pass the output of this query to the of my code but the is not supporting the time format generated by the query so please help in changing the time format

output = AUDIT_TIME="2018-06-05 21:00:02"

Query :

index="jboss" AUDIT_DATA="XXXXX" AND AUDIT_DATA=""XXXX8"" AUDIT_TIME>="2018-06-05 21:00:00" | table AUDIT_TIME | sort AUDIT_TIME | uniq | sort 2 AUDIT_TIME | reverse | return AUDIT_TIME

i wanna pass this output value AUDIT_TIME in

[Vigneshprasanna]

Hi @PowerPacked and @sukisen1981

I'm going wrong somewhere 😞 can you please check and correct me i have modified the query and tried for my case but its not working 😞

this is my sample data
2018-05-14 14:25:00,108 INFO com.xxxxxxx.browser.servlets.BrowserServlet 123-132-0-23-0

2018-05-14 14:25:00 -> i wanna pass this part as the input for the tag $earliest$

   <earliest>$earliest$</earliest>

[PowerPacked]

Hi @Vigneshprasanna

use this query to extract the time from result.

index="jboss" AUDIT_DATA="XXXXX" AND AUDIT_DATA=""XXXX8"" AUDIT_TIME>="2018-06-05 21:00:00" | table AUDIT_TIME | sort AUDIT_TIME | uniq | sort 2 AUDIT_TIME | reverse | return AUDIT_TIME | rex "AUDIT_TIME=\"(?P<time>.*)\"" | fields time

Thanks

[Sukisen1981]

pass audit time in where? do you mean you want to extract / sort by audit time?

[Vigneshprasanna]

Hi @sukisen1981

i wanna pass the AUDIT_TIME in

Jboss Drilldown

<panel>
  <table>
    <title>Dynamic drilldown Jboss Request/Response</title>
    <search>
      <query>  **Query that will return AUDIT_TIME** </query>
      **<earliest>$earliest$</earliest>**   - **should pass the audit time here** 
      <latest>$latest$</latest>
      </search>
       </table>
</panel>

This is jest an example snippit may have some more errors too hope this helps us to understand where we have to pass the AUDIT_TIME..

Thanks for the support in advance.

Regards,
Vigneshprasanna R