Splunk Search

Convert epoch time from drilldown parameter

feickertmd
Communicator

I have set up a drilldown to jump from a timechart graph to another dashboard.

<link>
<![CDATA[
/app/SPSearchData/drilldown_search_and_results?status=$click.name2$&earliest=$earliest$&latest=$latest$
]]>
</link>
</drilldown>

The resulting URL for the target dashboard displays like this:
/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1395205200&latest=1395810000#en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1395205200&latest=1395810000

Note that the earliest and latest params are set to Epoch time. I would like to have a HTML label above the chart that uses tokens to update ("$status$ from $earliest$ to $latest$"). My problem is that it comes up like:
Abandoned searches from 1395205200 to 1395810000

Is there any way I can format those epoch timestamps to be able to display them to the user in a readable format?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could add a time range picker and feed your tokens into that, that way the user can both see the time range (to some degree) and manipulate it as well.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could add a time range picker and feed your tokens into that, that way the user can both see the time range (to some degree) and manipulate it as well.

martin_mueller
SplunkTrust
SplunkTrust

You can save yourself some customization if you leave off the custom token name for the time input... assuming that's the only time range picker on the dashboard.

0 Karma

feickertmd
Communicator

I tried that with this:

<input type="time" token="time_token">
<label />
<default>
<earliestTime>$earliest$</earliestTime>
<latestTime >$latest$</latestTime>
</default>
</input>

I had done that, but I realize now that I had to redefine how I was passing tokens. I was getting
http://apsrd3084:8000/en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=...

I needed to change the sending form to send the tokens in the proper format.

Thanks again!

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...