Splunk Search

Convert epoch time from drilldown parameter

feickertmd
Communicator

I have set up a drilldown to jump from a timechart graph to another dashboard.

<link>
<![CDATA[
/app/SPSearchData/drilldown_search_and_results?status=$click.name2$&earliest=$earliest$&latest=$latest$
]]>
</link>
</drilldown>

The resulting URL for the target dashboard displays like this:
/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1395205200&latest=1395810000#en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1395205200&latest=1395810000

Note that the earliest and latest params are set to Epoch time. I would like to have a HTML label above the chart that uses tokens to update ("$status$ from $earliest$ to $latest$"). My problem is that it comes up like:
Abandoned searches from 1395205200 to 1395810000

Is there any way I can format those epoch timestamps to be able to display them to the user in a readable format?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could add a time range picker and feed your tokens into that, that way the user can both see the time range (to some degree) and manipulate it as well.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could add a time range picker and feed your tokens into that, that way the user can both see the time range (to some degree) and manipulate it as well.

martin_mueller
SplunkTrust
SplunkTrust

You can save yourself some customization if you leave off the custom token name for the time input... assuming that's the only time range picker on the dashboard.

0 Karma

feickertmd
Communicator

I tried that with this:

<input type="time" token="time_token">
<label />
<default>
<earliestTime>$earliest$</earliestTime>
<latestTime >$latest$</latestTime>
</default>
</input>

I had done that, but I realize now that I had to redefine how I was passing tokens. I was getting
http://apsrd3084:8000/en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=...

I needed to change the sending form to send the tokens in the proper format.

Thanks again!

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...