Splunk Search

How to use the time input field to calculate time as seconds?

New Member

Hi,

In my form, I have labeled my time input as field3 such as:

     input type="time" token="field3" searchWhenChanged="true"

In the search below it, I want to calculate the time as seconds, using

 | eval time_s=$field3.latest$ - $field3.earliest$

But I got error.

Any idea how to use the Time Input field to calculate the time in seconds?

Thanks.

0 Karma
1 Solution

Esteemed Legend

As an alternative, you can do this instead:

... | addinfo | eval time_s = info_max_time - info_min_time

View solution in original post

Legend

I am not sure of the purpose of this calculation, however, Earliest and Latest Time selected in a Search through Input Control are available as $job.searchLatestTime$ and $job.searchEarliestTime$ in preview and finalized search event handler. You can use eval attribute to calculate time span in seconds applied to search via time input.

    <search>
      <query>|makeresults </query>
      <earliest>$field3.earliest$</earliest>
      <latest>$field3.latest$</latest>
      <sampleRatio>1</sampleRatio>
      <preview>
        <eval token="SearchSpan">$job.searchLatestTime$-$job.searchEarliestTime$</eval>  
      </preview>
    </search>

You can then use the token in your form like in the following HTML panel

  <html>
    Selected Time Span=$SearchSpan$
  </html>
</panel>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Esteemed Legend

That should definitely work.

0 Karma

Esteemed Legend

As an alternative, you can do this instead:

... | addinfo | eval time_s = info_max_time - info_min_time

View solution in original post

SplunkTrust
SplunkTrust

Upvote because for this usage, there's no reason to futz with anything else.

0 Karma

Esteemed Legend

The really nice thing about this option is that you might have multiple timepickers and even then, you might override all of them with earliest=; this should handle every case with no thinking/planning/upkeep.

0 Karma

Esteemed Legend

Whenever you get an error, you should report the error text, too.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!