Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About drtwite
drtwite
New Member
Member since:
11-01-2021
01-31-2022
Community Statistics
| Posts | 3 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-01-2021 |
Activity Feed
- Posted Re: Extract Time Picker text generated by Splunk Enterprise into a token for use in a report on Getting Data In. 01-31-2022 12:26 AM
- Posted Re: Extract Time Picker text generated by Splunk Enterprise into a token for use in a report on Getting Data In. 01-10-2022 07:16 AM
- Posted Extract Time Picker text generated by Splunk Enterprise into a token for use in a report on Getting Data In. 01-10-2022 05:15 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
01-31-2022
12:26 AM
I have coded a work around for this now - see snippet below. It duplicates the text produced by Splunk in the Time Range filter for most Preset values, and for date ranges defaults to a To.... From.... format that is suitable for printed reports (where the filters are not included in the report). Let me know if you find any problems with the code. DrTwite. <input type="time" token="field1"> <label>Time Frame</label> <change> <!-- On change in time picker - update appropriate Earliest/Latest time variables --> <condition match="($mode$="Real" AND $initialise$="done")"> <set token="realEarliestTime">$form.field1.earliest$</set> <set token="realLatestTime">$form.field1.latest$</set> <set token="fe">$form.field1.earliest$</set> <!-- This block of 8 lines decodes the Time Modifier coming out of the Time Picker into readable text in variable TimeFrame, eg. -24h decodes to "Last 24 hours". Real Mode & Sample mode versions are identicle. --> <set token="fl">$form.field1.latest$</set> <eval token="suf">substr(ltrim(replace(replace(replace(fe,"mon","M"),"w1","W"),"w0","w"),"-0123456789rt@"),1,1)</eval> <eval token="suf">if(suf == "y"," year",if(suf == "q"," quarter",if(suf == "m"," minute",if(suf == "M"," month",if(suf == "s"," second",if(suf == "h"," hour",if(suf == "d"," day",if(suf == "w"," week",if(suf == "W"," business week","-")))))))))</eval> <eval token="fe">if(fe == "@d","Today",if(fe == "-1d@d","Yesterday",if(fe == "-7d@w0","Previous week",if(fe == "-6d@w1","Previous business week",if(fe == "-1mon@mon","Previous month",if(substr(fe,1,3) == "rt-",substr(rtrim(fe,$alpha$),4).suf." window",fe))))))</eval> <eval token="fe">if(fe == "-1y@y","Previous year",if(substr(fe,1,1) == "-","Last ".substr(rtrim(fe,$alpha$),2).suf."s",if(substr(fe,1,1) == "@",upper(substr(suf,2,1)).substr(suf,3)." to date",fe)))</eval> <eval token="fe">if(suf.fe.fl == "-0","All time",if(suf.fe.fl == "-rtrt","All time (real time)",if(suf.fe == "-0","Before ".strftime(fl,"%H:%M %e-%b-%Y"),if(suf.fl == "-now","Since ".strftime(fe,"%H:%M %e-%b-%Y"),if(suf == "-","*",fe)))))</eval> <eval token="form.TimeFrame">if(suf.fe == "-*","From ".strftime($form.field1.earliest$,"%H:%M %e-%b-%Y")." to ".strftime($form.field1.latest$,"%H:%M %e-%b-%Y"),fe)</eval> </condition> <condition match="$mode$="Sample""> <set token="sampleEarliestTime">$form.field1.earliest$</set> <set token="sampleLatestTime">$form.field1.latest$</set> <set token="fe">$form.field1.earliest$</set> <!-- This block of 8 lines decodes the Time Modifier coming out of the Time Picker into readable text in variable TimeFrame, eg. -24h decodes to "Last 24 hours". Real Mode & Sample mode versions are identicle. --> <set token="fl">$form.field1.latest$</set> <eval token="suf">substr(ltrim(replace(replace(replace(fe,"mon","M"),"w1","W"),"w0","w"),"-0123456789rt@"),1,1)</eval> <eval token="suf">if(suf == "y"," year",if(suf == "q"," quarter",if(suf == "m"," minute",if(suf == "M"," month",if(suf == "s"," second",if(suf == "h"," hour",if(suf == "d"," day",if(suf == "w"," week",if(suf == "W"," business week","-")))))))))</eval> <eval token="fe">if(fe == "@d","Today",if(fe == "-1d@d","Yesterday",if(fe == "-7d@w0","Previous week",if(fe == "-6d@w1","Previous business week",if(fe == "-1mon@mon","Previous month",if(substr(fe,1,3) == "rt-",substr(rtrim(fe,$alpha$),4).suf." window",fe))))))</eval> <eval token="fe">if(fe == "-1y@y","Previous year",if(substr(fe,1,1) == "-","Last ".substr(rtrim(fe,$alpha$),2).suf."s",if(substr(fe,1,1) == "@",upper(substr(suf,2,1)).substr(suf,3)." to date",fe)))</eval> <eval token="fe">if(suf.fe.fl == "-0","All time",if(suf.fe.fl == "-rtrt","All time (real time)",if(suf.fe == "-0","Before ".strftime(fl,"%H:%M %e-%b-%Y"),if(suf.fl == "-now","Since ".strftime(fe,"%H:%M %e-%b-%Y"),if(suf == "-","*",fe)))))</eval> <eval token="form.TimeFrame">if(suf.fe == "-*","From ".strftime($form.field1.earliest$,"%H:%M %e-%b-%Y")." to ".strftime($form.field1.latest$,"%H:%M %e-%b-%Y"),fe)</eval> </condition> <condition match="$initialise$="start""> <set token="form.field1.earliest">$realEarliestTime$</set> <set token="form.field1.latest">$realLatestTime$</set> <set token="form.TimeFrame">$realEarliestTime$.1</set> <set token="initialise">done</set> </condition> </change> </input>
... View more
01-10-2022
07:16 AM
Hi ITWhisperer Thanks for your reply - I have had a look at the solution that you refer to, the principle it is basically the same as my existing code - endeavouring to reconstruct the displayed text from the earliest and latest token values that only works in certain cases. Ideally Splunk should provide a token that contains a direct copy of the text being used in the Time Picker label itself if there isn't one already? Mike
... View more
01-10-2022
05:15 AM
I am trying to set a token ($TimeFrame$) to contain the same text as displayed by the Time Frame filter after having selected any particular time picker range – in this case “Last 13 Days” selected from Relative section of the Time Picker – but any time picker range or preset text being displayed in the Time Frame filter must work - see diagram below. I would like to extract exactly the same text that Splunk>Enterprise puts in the filter display box and assign it to my token $TimeFrame$. I can only find solutions that work in a limited number of cases because it involves trying to convert the formatted earliest and latest tokens back into text, for example, the code below works some of the time, but not for “Last 13 Days”, and is very messy having to deal with with special cases individually, for example “All Time”: <eval token="picktime">"From ".strftime($field1.earliest$,"%H:%M %e-%b-%Y")." to ".strftime($field1.latest$,"%H:%M %e-%b-%Y")</eval> <eval token="TimeFrame">if($picktime$ == "From 01:00 1-Jan-1970 to 01:00 1-Jan-1970" OR $picktime$ == "From 00:00 1-Jan-1970 to 00:00 1-Jan-1970","All time",$picktime$)</eval> Anyone know of a better way of doing this? Mike
... View more
Labels
- Labels:
-
field extraction
-
time
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-31-2022
03:47 AM
|
