Splunk Search
Highlighted

How to use the time input field to calculate time as seconds?

New Member

Hi,

In my form, I have labeled my time input as field3 such as:

     input type="time" token="field3" searchWhenChanged="true"

In the search below it, I want to calculate the time as seconds, using

 | eval time_s=$field3.latest$ - $field3.earliest$

But I got error.

Any idea how to use the Time Input field to calculate the time in seconds?

Thanks.

0 Karma
Highlighted

Re: How to use the time input field to calculate time as seconds?

Esteemed Legend

Whenever you get an error, you should report the error text, too.

0 Karma
Highlighted

Re: How to use the time input field to calculate time as seconds?

Esteemed Legend

As an alternative, you can do this instead:

... | addinfo | eval time_s = info_max_time - info_min_time

View solution in original post

Highlighted

Re: How to use the time input field to calculate time as seconds?

SplunkTrust
SplunkTrust

Upvote because for this usage, there's no reason to futz with anything else.

0 Karma
Highlighted

Re: How to use the time input field to calculate time as seconds?

Esteemed Legend

The really nice thing about this option is that you might have multiple timepickers and even then, you might override all of them with earliest=; this should handle every case with no thinking/planning/upkeep.

0 Karma
Highlighted

Re: How to use the time input field to calculate time as seconds?

Esteemed Legend

That should definitely work.

0 Karma
Highlighted

Re: How to use the time input field to calculate time as seconds?

Legend

I am not sure of the purpose of this calculation, however, Earliest and Latest Time selected in a Search through Input Control are available as $job.searchLatestTime$ and $job.searchEarliestTime$ in preview and finalized search event handler. You can use eval attribute to calculate time span in seconds applied to search via time input.

    <search>
      <query>|makeresults </query>
      <earliest>$field3.earliest$</earliest>
      <latest>$field3.latest$</latest>
      <sampleRatio>1</sampleRatio>
      <preview>
        <eval token="SearchSpan">$job.searchLatestTime$-$job.searchEarliestTime$</eval>  
      </preview>
    </search>

You can then use the token in your form like in the following HTML panel

  <html>
    Selected Time Span=$SearchSpan$
  </html>
</panel>
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.