Getting Data In

Why are dependent dynamic drop-down inputs displaying epoch time values instead of the format HH:MM in Simple XML?

tdiestel
Path Finder

Hi All;

3 Drop down inputs right now are being used as a custom timepicker. The first one is used to select any of the past 7 days. It displays the date and then passes the epoch time for the date selected to the other 2 prompts. The other 2 drop downs then take the epoch value and inserts it into the search query and creates a time aspect to the date selected. When everything works great it looks like this:

alt text

Now the problem rises when i then go to change the date to let's say "February 24", the From and To prompts then for some reason display the Epoch value instead of the display labels, and the Epoch Value is not passed to the rest of the panels in the dashboard:

alt text

But when I the select values for the From and To prompts everything acts as it should.

Has anyone had a similar problem like this and knows if it can be fixed? Any help is greatly appreciated.

Thanks,
Tyler

Also, here is my lengthy code for the inputs:

<input type="dropdown" token="date" searchWhenChanged="true">
  <label>Select a Date</label>
  <search>
    <query>|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-86400 |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(2*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(3*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(4*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(5*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(6*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(7*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]| table time dateadded_epoch</query>
    <earliest>0</earliest>
  </search>
  <fieldForLabel>time</fieldForLabel>
  <fieldForValue>dateadded_epoch</fieldForValue>
  <choice value="0| eval time=strftime(now(),&quot;%Y %B %d&quot;) |fields time | eval dateadded_epoch=strptime(time, &quot;%Y %B %d&quot;)|dedup time dateadded_epoch| eval time_of_day=dateadded_epoch">Today</choice>
  <default>0| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=dateadded_epoch</default>
</input>
<input type="dropdown" token="earliest_test" searchWhenChanged="true">
  <label>From:</label>
  <search>
    <query>|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$|eval display_time="00:00"|append[|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+3600|eval display_time="01:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(2*3600)|eval display_time="02:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(3*3600)|eval display_time="03:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(4*3600)|eval display_time="04:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(5*3600)|eval display_time="05:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(6*3600)|eval display_time="06:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(7*3600)|eval display_time="07:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(8*3600)|eval display_time="08:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(9*3600)|eval display_time="09:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(10*3600)|eval display_time="10:00"] | append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(11*3600)|eval display_time="11:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(12*3600)|eval display_time="12:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(13*3600)|eval display_time="13:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(14*3600)|eval display_time="14:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(15*3600)|eval display_time="15:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(16*3600)|eval display_time="16:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(17*3600)|eval display_time="17:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(18*3600)|eval display_time="18:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(19*3600)|eval display_time="19:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(20*3600)|eval display_time="20:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(21*3600)|eval display_time="21:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(22*3600)|eval display_time="22:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(23*3600)|eval display_time="23:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(24*3600)-1|eval display_time="23:59"]| fields display_time time_of_day</query>
  </search>
  <fieldForLabel>display_time</fieldForLabel>
  <fieldForValue>time_of_day</fieldForValue>
</input>
<input type="dropdown" token="latest_test" searchWhenChanged="true">
  <label>To:</label>
  <search>
    <query>|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$|eval display_time="00:00"|append[|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+3600|eval display_time="01:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(2*3600)|eval display_time="02:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(3*3600)|eval display_time="03:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(4*3600)|eval display_time="04:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(5*3600)|eval display_time="05:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(6*3600)|eval display_time="06:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(7*3600)|eval display_time="07:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(8*3600)|eval display_time="08:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(9*3600)|eval display_time="09:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(10*3600)|eval display_time="10:00"] | append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(11*3600)|eval display_time="11:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(12*3600)|eval display_time="12:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(13*3600)|eval display_time="13:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(14*3600)|eval display_time="14:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(15*3600)|eval display_time="15:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(16*3600)|eval display_time="16:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(17*3600)|eval display_time="17:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(18*3600)|eval display_time="18:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(19*3600)|eval display_time="19:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(20*3600)|eval display_time="20:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(21*3600)|eval display_time="21:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(22*3600)|eval display_time="22:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(23*3600)|eval display_time="23:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(24*3600)-1|eval display_time="23:59"]| fields display_time time_of_day</query>
  </search>
  <fieldForLabel>display_time</fieldForLabel>
  <fieldForValue>time_of_day</fieldForValue>
</input>
1 Solution

tdiestel
Path Finder

Ok i tried a ton of different things, but what finally did it for me was Adding in a "Submit" button. Now everything is working as expected, and i never even have to hit the submit button too. it just seems to work.

If anyone else runs into this issue, try this. It can be added by going to "Add Inputs" and then click "Submit"

-Tyler

View solution in original post

tdiestel
Path Finder

Ok i tried a ton of different things, but what finally did it for me was Adding in a "Submit" button. Now everything is working as expected, and i never even have to hit the submit button too. it just seems to work.

If anyone else runs into this issue, try this. It can be added by going to "Add Inputs" and then click "Submit"

-Tyler

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...