Dashboards & Visualizations

How do I convert time from a time range picker to epoch?

nick405060
Motivator

The following works for e.g. last week, last month, etc., but doesn't work where $TIMERANGE.latest$ is set by the picker to "now", or to a specific datetime value.

eval latest_EPOCH=relative_time(now(),"$TIMERANGE.latest$")

I've tried doing

eval temp=if("$TIMERANGE.latest$"=="now","-0m","$TIMERANGE.latest$") | eval latest_EPOCH=relative_time(now(),temp)

and that fixes "now" but not specific date ranges.

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Hi Nick,

Here is one way to do it:

earliest=coalesce(if(isnum($TIMERANGE.earliest$"),$TIMERANGE.earliest$,relative_time(now(),$TIMERANGE.earliest$)),0)

latest=coalesce(if(isnum($TIMERANGE.latest$"),$TIMERANGE.latest$",relative_time(now(),$TIMERANGE.latest$")),99999999999)

Good luck

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you're inside a dashboard, this is much much faster:

<input type="time" token="time">
  <label></label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
  <change>
    <eval token="earliest_epoch">case(isnum($earliest$), $earliest$, $earliest$=="now", time(), $earliest$="", 0, true(), relative_time(time(), $earliest$))</eval>
    <eval token="latest_epoch">case(isnum($latest$), $latest$, $latest$=="now", time(), true(), relative_time(time(), $latest$))</eval>
  </change>
</input>

verbal_666
Builder

Great 👏👏👏👏👏👍
But maybe dashboard will not update variables/tokens until you manually change the picker.
Let's say i choose "-5m" from picker and latest is "now" for default, it will remain fixed to

relative_time(time(), $earliest$)

 the UNIX-time value, also if my panels refreshes.

So, letting dashboard has refreshing panels, the -5m will become -6 -7 -8 -9 -10 ......... untill you change the picker...

Also for

$latest$=="now", time()

Same concept for earliest... it becomes fixed until you refresh entire dashboard/picker.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi Nick,

Here is one way to do it:

earliest=coalesce(if(isnum($TIMERANGE.earliest$"),$TIMERANGE.earliest$,relative_time(now(),$TIMERANGE.earliest$)),0)

latest=coalesce(if(isnum($TIMERANGE.latest$"),$TIMERANGE.latest$",relative_time(now(),$TIMERANGE.latest$")),99999999999)

Good luck

verbal_666
Builder

Great, thanks 👏👏👏

I took my way, doing so,

 

|eval earliest_epoch="$time.earliest$",latest_epoch="$time.latest$"
|eval earliest_epoch=case(isnum(earliest_epoch),earliest_epoch,earliest_epoch=="now",time(),"earliest_epoch"="",0,true(),relative_time(time(),earliest_epoch))
|eval latest_epoch=case(isnum(latest_epoch),latest_epoch,latest_epoch=="now",time(),true(),relative_time(time(),latest_epoch))

 

 

0 Karma

nick405060
Motivator

ty again! posted here on SA as well in case it helps anyone else out.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

OK A better solution thanks to @micahkemp would be to do this :

your_search | addinfo | eval latest_EPOCH = info_max_time (or use rename)

nick405060
Motivator

for that solution (the better solution) make sure you also have

<earliest>$TIMERANGE.earliest$</earliest>
<latest>$TIMERANGE.latest$</latest>

after the query stanza otherwise addinfo doesn't know where to get earliest and latest from; it will just default to be all-time

0 Karma

nick405060
Motivator

So the solution posted here by @micahkemp does NOT work if you are using a post-process search, since the earliest and latest stanzas have to be identical to the base search. However the answers provided by @martin_mueller and @chrisyoungerjds will work

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...