Getting Data In

Time format

Vigneshprasanna
Explorer

Hi Mates,

i get output of a query as below, i would like to pass the output of this query to the of my code but the is not supporting the time format generated by the query so please help in changing the time format

output = AUDIT_TIME="2018-06-05 21:00:02"

Query :

index="jboss" AUDIT_DATA="XXXXX" AND AUDIT_DATA=""XXXX8"" AUDIT_TIME>="2018-06-05 21:00:00" | table AUDIT_TIME | sort AUDIT_TIME | uniq | sort 2 AUDIT_TIME | reverse | return AUDIT_TIME

i wanna pass this output value AUDIT_TIME in

alt text

0 Karma

Vigneshprasanna
Explorer

Hi @PowerPacked and @sukisen1981

I'm going wrong somewhere 😞 can you please check and correct me i have modified the query and tried for my case but its not working 😞

this is my sample data
2018-05-14 14:25:00,108 INFO com.xxxxxxx.browser.servlets.BrowserServlet 123-132-0-23-0

2018-05-14 14:25:00 -> i wanna pass this part as the input for the tag $earliest$

alt text

   <earliest>$earliest$</earliest>
0 Karma

PowerPacked
Builder

Hi @Vigneshprasanna

use this query to extract the time from result.

index="jboss" AUDIT_DATA="XXXXX" AND AUDIT_DATA=""XXXX8"" AUDIT_TIME>="2018-06-05 21:00:00" | table AUDIT_TIME | sort AUDIT_TIME | uniq | sort 2 AUDIT_TIME | reverse | return AUDIT_TIME | rex "AUDIT_TIME=\"(?P<time>.*)\"" | fields time

Thanks

0 Karma

Sukisen1981
Champion

pass audit time in where? do you mean you want to extract / sort by audit time?

0 Karma

Vigneshprasanna
Explorer

Hi @sukisen1981

i wanna pass the AUDIT_TIME in

Jboss Drilldown

<panel>
  <table>
    <title>Dynamic drilldown Jboss Request/Response</title>
    <search>
      <query>  **Query that will return AUDIT_TIME** </query>
      **<earliest>$earliest$</earliest>**   - **should pass the audit time here** 
      <latest>$latest$</latest>
      </search>
       </table>
</panel>

This is jest an example snippit may have some more errors too hope this helps us to understand where we have to pass the AUDIT_TIME..

Thanks for the support in advance.

Regards,
Vigneshprasanna R

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...