Dashboards & Visualizations

How do you transform a subsearch into a string literal and not SPL?

pcatasus
Engager

I have a token I want to set up when I first init dashboard:
[stats count | eval search=strftime(now(), "mysearch%y%m%d%H%M%S.csv")]
But this gets interpreted dynamically throughout changing the name of the file. I just want to have a timestamp literal I can reuse. Been at it for a while using fieldformat, print, etc. Thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

You can init strftime(now(), "mysearch%y%m%d%H%M%S.csv") first then use it in the actual token.

<init>
    <eval token="filename">strftime(now(), "mysearch%y%m%d%H%M%S.csv")</eval>
    <set token="search">[stats count | eval search=$filename$]</set>
  </init>

View solution in original post

manjunathmeti
Champion

You can init strftime(now(), "mysearch%y%m%d%H%M%S.csv") first then use it in the actual token.

<init>
    <eval token="filename">strftime(now(), "mysearch%y%m%d%H%M%S.csv")</eval>
    <set token="search">[stats count | eval search=$filename$]</set>
  </init>

pcatasus
Engager

Worked like a charm! Thank you!

0 Karma

manjunathmeti
Champion

Please accept answer.

0 Karma

pcatasus
Engager

Sorry! Done.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...