Splunk Search

Time token returning NAN error

av_
Path Finder

I have a time picker & a time dropdown which has static values.  

<panel id="pqr">
<input type="time" token="time">
<label>DateTime</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
</panel>

<panel id="abc">
<input type="dropdown" token="timedrop">
<label>Time Dropdown</label>
<choice value="now">Now</choice>
<choice value="+3d">3d</choice>
<choice value="+4d">4d</choice>
<choice value="+5d">5d</choice>
<default>now</default>
<change>
<eval token="latest_Time">if('timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>
</change>
</input>
</panel>



The expectation is if Now is selected in timedrop, the data till now should load. If +3d is selected in timedrop, then +3d should be added with the time.latest token (coming from the time picker) and so on.
On load (by default Today is selected), the latest_Time is returning NAN, but if I select a specific time range (say 8th April 10AM-11AM) & timedrop as 3d, it is working as expected.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try like this:

    <panel id="pqr">
      <input type="time" token="time">
        <label>DateTime</label>
        <default>
          <earliest>@d</earliest>
          <latest>now</latest>
        </default>
      </input>
    </panel>
    <panel id="abc">
      <title>Latest time token $latest_Time$</title>
      <input type="dropdown" token="timedrop">
        <label>Time Dropdown</label>
        <choice value="now">Now</choice>
        <choice value="+3d">3d</choice>
        <choice value="+4d">4d</choice>
        <choice value="+5d">5d</choice>
        <default>now</default>
        <change>
          <eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>
        </change>
      </input>
    </panel>

There doesn't seem to be a way to set an initial value on a time input - perhaps this is a bug?

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try like this:

    <panel id="pqr">
      <input type="time" token="time">
        <label>DateTime</label>
        <default>
          <earliest>@d</earliest>
          <latest>now</latest>
        </default>
      </input>
    </panel>
    <panel id="abc">
      <title>Latest time token $latest_Time$</title>
      <input type="dropdown" token="timedrop">
        <label>Time Dropdown</label>
        <choice value="now">Now</choice>
        <choice value="+3d">3d</choice>
        <choice value="+4d">4d</choice>
        <choice value="+5d">5d</choice>
        <default>now</default>
        <change>
          <eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>
        </change>
      </input>
    </panel>

There doesn't seem to be a way to set an initial value on a time input - perhaps this is a bug?

av_
Path Finder

Tried this method but for some reason I still see the same error. 

av__0-1714043422536.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

All you have shown is a screen grab of something that isn't working without any detail of what you have actually tried i.e. the SimpleXML you are using in this instance. Please share some useful information.

0 Karma

av_
Path Finder

I've already given all the details & mentioned earlier that I used your method.  To be specific, I used this below mentioned statement in the "timedrop" dropdown change section.
But still getting Nan error

<panel id="pqr">
<input type="time" token="time">
<label>DateTime</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
</panel>

<panel id="abc">
<input type="dropdown" token="timedrop">
<label>Time Dropdown</label>
<choice value="now">Now</choice>
<choice value="+3d">3d</choice>
<choice value="+4d">4d</choice>
<choice value="+5d">5d</choice>
<default>now</default>
<change>
<eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval></change>
</input>
</panel>
0 Karma

av_
Path Finder

@ITWhisperer I've removed the option Now from the dropdown, what should be the new eval statement instead of

<eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>

?

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If now is no longer an option, there should be no reason to check for it!

Try something like this

<eval token="latest_Time">relative_time($time.latest$, $timedrop$)</eval>

Don't forget to change the default for the dropdown to something other than now

0 Karma

av_
Path Finder

The statement is not working. 

av__0-1715587205616.png

 

According to the above selection made, the earliest time should be 5/8/2024 05:00:00 & latest time should be 5/9/2024 06:00:00 (because the time span selected is +1d) but it is not working despite of using the below eval statement. 

<eval token="latest_Time">relative_time($time.latest$, $timedrop$)</eval>

Results:

av__1-1715587458465.png

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share the source of your dashboard, just sharing screengrabs does not show what is going on behind the scenes!

0 Karma

av_
Path Finder
<form version="1.1">
  <label>My dashboard</label>
  <fieldset submitButton="false"></fieldset>
 
  <row id="mainFilterRow" depends="$showHidePanel$">
    <panel id="mainFilterPanel1">
      <input type="time" token="time">
        <label>DateTime</label>
        <default>
          <earliest>@d</earliest>
          <latest>now</latest>
        </default>
      </input>
    </panel>
   
    <panel id="mainFilterPanel21">
      <input type="dropdown" token="TimeDrop">
        <label>TimeDrop</label>
        <choice value="+1d">1d</choice>
        <choice value="+2d">2d</choice>
        <choice value="+5d">5d</choice>
        <default>1d</default>
        <change>
          <eval token="latest_Time">relative_time($time.latest$, $TimeDrop$)</eval>
        </change>
      </input>
    </panel>
  </row>
  <row id="chartRow" depends="$showHidePanel$">
    <panel>
        <search>
      <query>index=main
| stats count by host</query>
         
          <earliest>$time.earliest$</earliest>
          <latest>$latest_Time$</latest>
        </search>
        </panel>
  </row>
</form>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try adding an init block

  <init>
    <eval token="latest_Time">relative_time(now(), "+1d")</eval>
  </init>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Except that the screen grab you showed is not from this SimpleXML code

ITWhisperer_0-1714046382573.png

 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...