Splunk Search

Changing how time is displayed based on user input

exocore123
Path Finder

I have a dashboard with a range of aggregation span from 1h, 1d, 7d, 1mon. And I want to change how timestamp is displayed depending on the user input for aggregation span, something like this

eval Timestamp=case($span$="1mon", strftime(_time,"%b %Y"), $span$="1d" OR $span$="7d", strftime(_time,"%d %b %Y"))

However, I keep getting a mismatched ) error, not sure how to work around this.

0 Karma
1 Solution

lguinn2
Legend

I don't really see a problem, but I wonder if it is something to do with the token. Try this and see what happens:

eval Timestamp=case("$span$"="1mon", strftime(_time,"%b %Y"),
                    "$span$"="1d" OR "$span$"="7d", strftime(_time,"%d %b %Y") )

View solution in original post

lguinn2
Legend

I don't really see a problem, but I wonder if it is something to do with the token. Try this and see what happens:

eval Timestamp=case("$span$"="1mon", strftime(_time,"%b %Y"),
                    "$span$"="1d" OR "$span$"="7d", strftime(_time,"%d %b %Y") )

View solution in original post

cmerriman
Super Champion

Or possible $span|s$ to encase the token value in quotes.
Is that where your search breaks? When you run everything before that eval it works?

0 Karma

exocore123
Path Finder

Yep, seems like I had to put the input in quotes, thank you

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!