Splunk Search

Time token returning NAN error

av_
Path Finder

I have a time picker & a time dropdown which has static values.  

<panel id="pqr">
<input type="time" token="time">
<label>DateTime</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
</panel>

<panel id="abc">
<input type="dropdown" token="timedrop">
<label>Time Dropdown</label>
<choice value="now">Now</choice>
<choice value="+3d">3d</choice>
<choice value="+4d">4d</choice>
<choice value="+5d">5d</choice>
<default>now</default>
<change>
<eval token="latest_Time">if('timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>
</change>
</input>
</panel>



The expectation is if Now is selected in timedrop, the data till now should load. If +3d is selected in timedrop, then +3d should be added with the time.latest token (coming from the time picker) and so on.
On load (by default Today is selected), the latest_Time is returning NAN, but if I select a specific time range (say 8th April 10AM-11AM) & timedrop as 3d, it is working as expected.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try like this:

    <panel id="pqr">
      <input type="time" token="time">
        <label>DateTime</label>
        <default>
          <earliest>@d</earliest>
          <latest>now</latest>
        </default>
      </input>
    </panel>
    <panel id="abc">
      <title>Latest time token $latest_Time$</title>
      <input type="dropdown" token="timedrop">
        <label>Time Dropdown</label>
        <choice value="now">Now</choice>
        <choice value="+3d">3d</choice>
        <choice value="+4d">4d</choice>
        <choice value="+5d">5d</choice>
        <default>now</default>
        <change>
          <eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>
        </change>
      </input>
    </panel>

There doesn't seem to be a way to set an initial value on a time input - perhaps this is a bug?

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try like this:

    <panel id="pqr">
      <input type="time" token="time">
        <label>DateTime</label>
        <default>
          <earliest>@d</earliest>
          <latest>now</latest>
        </default>
      </input>
    </panel>
    <panel id="abc">
      <title>Latest time token $latest_Time$</title>
      <input type="dropdown" token="timedrop">
        <label>Time Dropdown</label>
        <choice value="now">Now</choice>
        <choice value="+3d">3d</choice>
        <choice value="+4d">4d</choice>
        <choice value="+5d">5d</choice>
        <default>now</default>
        <change>
          <eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>
        </change>
      </input>
    </panel>

There doesn't seem to be a way to set an initial value on a time input - perhaps this is a bug?

av_
Path Finder

Tried this method but for some reason I still see the same error. 

av__0-1714043422536.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

All you have shown is a screen grab of something that isn't working without any detail of what you have actually tried i.e. the SimpleXML you are using in this instance. Please share some useful information.

0 Karma

av_
Path Finder

I've already given all the details & mentioned earlier that I used your method.  To be specific, I used this below mentioned statement in the "timedrop" dropdown change section.
But still getting Nan error

<panel id="pqr">
<input type="time" token="time">
<label>DateTime</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
</panel>

<panel id="abc">
<input type="dropdown" token="timedrop">
<label>Time Dropdown</label>
<choice value="now">Now</choice>
<choice value="+3d">3d</choice>
<choice value="+4d">4d</choice>
<choice value="+5d">5d</choice>
<default>now</default>
<change>
<eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval></change>
</input>
</panel>
0 Karma

av_
Path Finder

@ITWhisperer I've removed the option Now from the dropdown, what should be the new eval statement instead of

<eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>

?

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If now is no longer an option, there should be no reason to check for it!

Try something like this

<eval token="latest_Time">relative_time($time.latest$, $timedrop$)</eval>

Don't forget to change the default for the dropdown to something other than now

0 Karma

av_
Path Finder

The statement is not working. 

av__0-1715587205616.png

 

According to the above selection made, the earliest time should be 5/8/2024 05:00:00 & latest time should be 5/9/2024 06:00:00 (because the time span selected is +1d) but it is not working despite of using the below eval statement. 

<eval token="latest_Time">relative_time($time.latest$, $timedrop$)</eval>

Results:

av__1-1715587458465.png

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share the source of your dashboard, just sharing screengrabs does not show what is going on behind the scenes!

0 Karma

av_
Path Finder
<form version="1.1">
  <label>My dashboard</label>
  <fieldset submitButton="false"></fieldset>
 
  <row id="mainFilterRow" depends="$showHidePanel$">
    <panel id="mainFilterPanel1">
      <input type="time" token="time">
        <label>DateTime</label>
        <default>
          <earliest>@d</earliest>
          <latest>now</latest>
        </default>
      </input>
    </panel>
   
    <panel id="mainFilterPanel21">
      <input type="dropdown" token="TimeDrop">
        <label>TimeDrop</label>
        <choice value="+1d">1d</choice>
        <choice value="+2d">2d</choice>
        <choice value="+5d">5d</choice>
        <default>1d</default>
        <change>
          <eval token="latest_Time">relative_time($time.latest$, $TimeDrop$)</eval>
        </change>
      </input>
    </panel>
  </row>
  <row id="chartRow" depends="$showHidePanel$">
    <panel>
        <search>
      <query>index=main
| stats count by host</query>
         
          <earliest>$time.earliest$</earliest>
          <latest>$latest_Time$</latest>
        </search>
        </panel>
  </row>
</form>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try adding an init block

  <init>
    <eval token="latest_Time">relative_time(now(), "+1d")</eval>
  </init>
0 Karma

av_
Path Finder

@ITWhisperer  I below eval statement in init block didn't work.

  <init>
    <eval token="latest_Time">relative_time(now(), "+1d")</eval>
  </init>

 I am using Javascript and there I have created two variables for earliest & latest time.

    var earliestTime = defaultTokens.get("time.earliest");
    var latestTime = defaultTokens.get("time.latest");
 
Do I need to use these variables in the Splunk dashboard in order to get the desired results?

Once again, the problem statement is that I have to add +1d to the latest time selected in the time token.
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

In what way didn't it work?

I am not using javascript and init blocks work for me!

0 Karma

av_
Path Finder

Without using JavaScript, it works as expected but I need to use JavaScript. 
I’m just assuming that due to the earliest and latest variables defined in JavaScript, the init block is not working for me.

Is there a way to solve this issue? 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Except that the screen grab you showed is not from this SimpleXML code

ITWhisperer_0-1714046382573.png

 

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...