Getting Data In

Why are dependent dynamic drop-down inputs displaying epoch time values instead of the format HH:MM in Simple XML?

tdiestel
Path Finder

Hi All;

3 Drop down inputs right now are being used as a custom timepicker. The first one is used to select any of the past 7 days. It displays the date and then passes the epoch time for the date selected to the other 2 prompts. The other 2 drop downs then take the epoch value and inserts it into the search query and creates a time aspect to the date selected. When everything works great it looks like this:

alt text

Now the problem rises when i then go to change the date to let's say "February 24", the From and To prompts then for some reason display the Epoch value instead of the display labels, and the Epoch Value is not passed to the rest of the panels in the dashboard:

alt text

But when I the select values for the From and To prompts everything acts as it should.

Has anyone had a similar problem like this and knows if it can be fixed? Any help is greatly appreciated.

Thanks,
Tyler

Also, here is my lengthy code for the inputs:

<input type="dropdown" token="date" searchWhenChanged="true">
  <label>Select a Date</label>
  <search>
    <query>|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-86400 |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(2*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(3*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(4*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(5*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(6*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(7*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]| table time dateadded_epoch</query>
    <earliest>0</earliest>
  </search>
  <fieldForLabel>time</fieldForLabel>
  <fieldForValue>dateadded_epoch</fieldForValue>
  <choice value="0| eval time=strftime(now(),&quot;%Y %B %d&quot;) |fields time | eval dateadded_epoch=strptime(time, &quot;%Y %B %d&quot;)|dedup time dateadded_epoch| eval time_of_day=dateadded_epoch">Today</choice>
  <default>0| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=dateadded_epoch</default>
</input>
<input type="dropdown" token="earliest_test" searchWhenChanged="true">
  <label>From:</label>
  <search>
    <query>|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$|eval display_time="00:00"|append[|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+3600|eval display_time="01:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(2*3600)|eval display_time="02:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(3*3600)|eval display_time="03:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(4*3600)|eval display_time="04:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(5*3600)|eval display_time="05:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(6*3600)|eval display_time="06:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(7*3600)|eval display_time="07:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(8*3600)|eval display_time="08:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(9*3600)|eval display_time="09:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(10*3600)|eval display_time="10:00"] | append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(11*3600)|eval display_time="11:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(12*3600)|eval display_time="12:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(13*3600)|eval display_time="13:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(14*3600)|eval display_time="14:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(15*3600)|eval display_time="15:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(16*3600)|eval display_time="16:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(17*3600)|eval display_time="17:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(18*3600)|eval display_time="18:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(19*3600)|eval display_time="19:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(20*3600)|eval display_time="20:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(21*3600)|eval display_time="21:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(22*3600)|eval display_time="22:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(23*3600)|eval display_time="23:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(24*3600)-1|eval display_time="23:59"]| fields display_time time_of_day</query>
  </search>
  <fieldForLabel>display_time</fieldForLabel>
  <fieldForValue>time_of_day</fieldForValue>
</input>
<input type="dropdown" token="latest_test" searchWhenChanged="true">
  <label>To:</label>
  <search>
    <query>|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$|eval display_time="00:00"|append[|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+3600|eval display_time="01:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(2*3600)|eval display_time="02:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(3*3600)|eval display_time="03:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(4*3600)|eval display_time="04:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(5*3600)|eval display_time="05:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(6*3600)|eval display_time="06:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(7*3600)|eval display_time="07:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(8*3600)|eval display_time="08:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(9*3600)|eval display_time="09:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(10*3600)|eval display_time="10:00"] | append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(11*3600)|eval display_time="11:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(12*3600)|eval display_time="12:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(13*3600)|eval display_time="13:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(14*3600)|eval display_time="14:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(15*3600)|eval display_time="15:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(16*3600)|eval display_time="16:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(17*3600)|eval display_time="17:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(18*3600)|eval display_time="18:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(19*3600)|eval display_time="19:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(20*3600)|eval display_time="20:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(21*3600)|eval display_time="21:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(22*3600)|eval display_time="22:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(23*3600)|eval display_time="23:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(24*3600)-1|eval display_time="23:59"]| fields display_time time_of_day</query>
  </search>
  <fieldForLabel>display_time</fieldForLabel>
  <fieldForValue>time_of_day</fieldForValue>
</input>
1 Solution

tdiestel
Path Finder

Ok i tried a ton of different things, but what finally did it for me was Adding in a "Submit" button. Now everything is working as expected, and i never even have to hit the submit button too. it just seems to work.

If anyone else runs into this issue, try this. It can be added by going to "Add Inputs" and then click "Submit"

-Tyler

View solution in original post

tdiestel
Path Finder

Ok i tried a ton of different things, but what finally did it for me was Adding in a "Submit" button. Now everything is working as expected, and i never even have to hit the submit button too. it just seems to work.

If anyone else runs into this issue, try this. It can be added by going to "Add Inputs" and then click "Submit"

-Tyler

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...