Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to use the time input field to calculate t...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
In my form, I have labeled my time input as field3 such as:
input type="time" token="field3" searchWhenChanged="true"
In the search below it, I want to calculate the time as seconds, using
| eval time_s=$field3.latest$ - $field3.earliest$
But I got error.
Any idea how to use the Time Input field to calculate the time in seconds?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As an alternative, you can do this instead:
... | addinfo | eval time_s = info_max_time - info_min_time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am not sure of the purpose of this calculation, however, Earliest and Latest Time selected in a Search through Input Control are available as $job.searchLatestTime$ and $job.searchEarliestTime$ in preview and finalized search event handler. You can use eval attribute to calculate time span in seconds applied to search via time input.
<search>
<query>|makeresults </query>
<earliest>$field3.earliest$</earliest>
<latest>$field3.latest$</latest>
<sampleRatio>1</sampleRatio>
<preview>
<eval token="SearchSpan">$job.searchLatestTime$-$job.searchEarliestTime$</eval>
</preview>
</search>
You can then use the token in your form like in the following HTML panel
<html>
Selected Time Span=$SearchSpan$
</html>
</panel>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That should definitely work.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As an alternative, you can do this instead:
... | addinfo | eval time_s = info_max_time - info_min_time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Upvote because for this usage, there's no reason to futz with anything else.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The really nice thing about this option is that you might have multiple timepickers and even then, you might override all of them with earliest=; this should handle every case with no thinking/planning/upkeep.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Whenever you get an error, you should report the error text, too.
Building Reliable Asset and Identity Frameworks in Splunk ES
Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting
Automatic Discovery Part 3: Practical Use Cases
