Splunk Search

Convert epoch time from drilldown parameter

feickertmd
Communicator

I have set up a drilldown to jump from a timechart graph to another dashboard.

<link>
<![CDATA[
/app/SPSearchData/drilldown_search_and_results?status=$click.name2$&earliest=$earliest$&latest=$latest$
]]>
</link>
</drilldown>

The resulting URL for the target dashboard displays like this:
/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1395205200&latest=1395810000#en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1395205200&latest=1395810000

Note that the earliest and latest params are set to Epoch time. I would like to have a HTML label above the chart that uses tokens to update ("$status$ from $earliest$ to $latest$"). My problem is that it comes up like:
Abandoned searches from 1395205200 to 1395810000

Is there any way I can format those epoch timestamps to be able to display them to the user in a readable format?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could add a time range picker and feed your tokens into that, that way the user can both see the time range (to some degree) and manipulate it as well.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could add a time range picker and feed your tokens into that, that way the user can both see the time range (to some degree) and manipulate it as well.

martin_mueller
SplunkTrust
SplunkTrust

You can save yourself some customization if you leave off the custom token name for the time input... assuming that's the only time range picker on the dashboard.

0 Karma

feickertmd
Communicator

I tried that with this:

<input type="time" token="time_token">
<label />
<default>
<earliestTime>$earliest$</earliestTime>
<latestTime >$latest$</latestTime>
</default>
</input>

I had done that, but I realize now that I had to redefine how I was passing tokens. I was getting
http://apsrd3084:8000/en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=...

I needed to change the sending form to send the tokens in the proper format.

Thanks again!

Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...