Dashboards & Visualizations

How do I convert time from a time range picker to epoch?

nick405060
Motivator

The following works for e.g. last week, last month, etc., but doesn't work where $TIMERANGE.latest$ is set by the picker to "now", or to a specific datetime value.

eval latest_EPOCH=relative_time(now(),"$TIMERANGE.latest$")

I've tried doing

eval temp=if("$TIMERANGE.latest$"=="now","-0m","$TIMERANGE.latest$") | eval latest_EPOCH=relative_time(now(),temp)

and that fixes "now" but not specific date ranges.

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi Nick,

Here is one way to do it:

earliest=coalesce(if(isnum($TIMERANGE.earliest$"),$TIMERANGE.earliest$,relative_time(now(),$TIMERANGE.earliest$)),0)

latest=coalesce(if(isnum($TIMERANGE.latest$"),$TIMERANGE.latest$",relative_time(now(),$TIMERANGE.latest$")),99999999999)

Good luck

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you're inside a dashboard, this is much much faster:

<input type="time" token="time">
  <label></label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
  <change>
    <eval token="earliest_epoch">case(isnum($earliest$), $earliest$, $earliest$=="now", time(), $earliest$="", 0, true(), relative_time(time(), $earliest$))</eval>
    <eval token="latest_epoch">case(isnum($latest$), $latest$, $latest$=="now", time(), true(), relative_time(time(), $latest$))</eval>
  </change>
</input>

verbal_666
Builder

Great 👏👏👏👏👏👍
But maybe dashboard will not update variables/tokens until you manually change the picker.
Let's say i choose "-5m" from picker and latest is "now" for default, it will remain fixed to

relative_time(time(), $earliest$)

 the UNIX-time value, also if my panels refreshes.

So, letting dashboard has refreshing panels, the -5m will become -6 -7 -8 -9 -10 ......... untill you change the picker...

Also for

$latest$=="now", time()

Same concept for earliest... it becomes fixed until you refresh entire dashboard/picker.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi Nick,

Here is one way to do it:

earliest=coalesce(if(isnum($TIMERANGE.earliest$"),$TIMERANGE.earliest$,relative_time(now(),$TIMERANGE.earliest$)),0)

latest=coalesce(if(isnum($TIMERANGE.latest$"),$TIMERANGE.latest$",relative_time(now(),$TIMERANGE.latest$")),99999999999)

Good luck

verbal_666
Builder

Great, thanks 👏👏👏

I took my way, doing so,

 

|eval earliest_epoch="$time.earliest$",latest_epoch="$time.latest$"
|eval earliest_epoch=case(isnum(earliest_epoch),earliest_epoch,earliest_epoch=="now",time(),"earliest_epoch"="",0,true(),relative_time(time(),earliest_epoch))
|eval latest_epoch=case(isnum(latest_epoch),latest_epoch,latest_epoch=="now",time(),true(),relative_time(time(),latest_epoch))

 

 

0 Karma

nick405060
Motivator

ty again! posted here on SA as well in case it helps anyone else out.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

OK A better solution thanks to @micahkemp would be to do this :

your_search | addinfo | eval latest_EPOCH = info_max_time (or use rename)

nick405060
Motivator

for that solution (the better solution) make sure you also have

<earliest>$TIMERANGE.earliest$</earliest>
<latest>$TIMERANGE.latest$</latest>

after the query stanza otherwise addinfo doesn't know where to get earliest and latest from; it will just default to be all-time

0 Karma

nick405060
Motivator

So the solution posted here by @micahkemp does NOT work if you are using a post-process search, since the earliest and latest stanzas have to be identical to the base search. However the answers provided by @martin_mueller and @chrisyoungerjds will work

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...