Why am I getting error "Invalid earliest_time" trying to set a specific default setting for the date time picker?

[brutecat]

HI there,

I have been trying to set a specific date time in the default setting for the date time picker:

<fieldset autoRun="true" submitButton="false">
    <input type="time" token="time" searchWhenChanged="true">
        <label />
        <default>
          <earliestTime>04/01/2015:00:00:00 CET</earliestTime>
          <latestTime>now</latestTime>
        &lt;/default&gt;
    &lt;/input&gt;
&lt;/fieldset&gt;

I am taking the format from the docs which indicates %m/%d$Y:%H:%M:%S, but I keep getting an error when I try and run the query (Invalid earliest_time). I have tried multiple permutations with no success. Is this a locale dependency (I am in Australia and we usually reverse the month and day).

This is driving me crazy. Any advice would be well received!

Thanks,

Stan

[woodcock · Accepted solution]

The simplest way is to use Splunk-native epoch time (and add a comment to your code) and be done with it. Go to a site like this one to help you convert to epoch:

http://www.epochconverter.com/

You can also just do a search using the timepicker to set the date and pull the epoch time out of the URL under the URI &earliest=.

[brutecat]

@woodcock,

Thanks - perfect. Why do the docs then refer to a human readable format, or did I miss something,

Regards,

Stan