Dashboards & Visualizations

How to use eval on a token from a time picker and add it to a label for a chart?

KevinAdu
Explorer

In my Splunk Dashboard, I have a time picker and charts which shows a search for each subsequent day from the earliest time selected in the time picker.

I want to display a formatted date in a label for each chart. So for example:

Day 1 - 15/12/2015
Day 2 - 16/12/2015
Day 3 - 17/12/2015
etc

I understand that these dates can be derived from the time picker's token. Here is what I have attempted so far just for the first date but it does not seem to work:

<input type="time" token="InputTime">
      <label>TimePicker for SourceType</label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <eval token="new_time">strptime($InputTime.earliest$, "%m/%d/%Y")</eval>
        <title>Day 1 - $new_time$</title>

Could anybody tell me what I am doing wrong?
Thanks

1 Solution

JovanMilosevic
Path Finder

I know it's been a while, but might help someone else. Just been wrestling with similar problem. I've found that evals need to be inside the input block. Also, when tokens are used there, they need to be in single quotes. Finally, it's strftime rather than strptime. Try...

<input type="time" token="InputTime">
       <label>TimePicker for SourceType</label>
       <default>
         <earliest>-15m</earliest>
         <latest>now</latest>
       </default>
       <change>
         <eval token="new_time">strftime('InputTime.earliest', "%m/%d/%Y")</eval> 
       </change>
  </input>
   </fieldset>
   <row>
     <panel>
       <chart>
         <title>Day 1 - $new_time$</title>

View solution in original post

gcusello
Legend

Try to insert eval command in the search of a panel and then extract the token in the panel and show it in the panel's title.
But if you do this, you have to manage the showed columns to don't see the value in a column: in this case you have to use the <fields> option
Bye.
Giuseppe

0 Karma

JovanMilosevic
Path Finder

I know it's been a while, but might help someone else. Just been wrestling with similar problem. I've found that evals need to be inside the input block. Also, when tokens are used there, they need to be in single quotes. Finally, it's strftime rather than strptime. Try...

<input type="time" token="InputTime">
       <label>TimePicker for SourceType</label>
       <default>
         <earliest>-15m</earliest>
         <latest>now</latest>
       </default>
       <change>
         <eval token="new_time">strftime('InputTime.earliest', "%m/%d/%Y")</eval> 
       </change>
  </input>
   </fieldset>
   <row>
     <panel>
       <chart>
         <title>Day 1 - $new_time$</title>

rmarcum
Explorer

Hi JovanMilosevic, did this indeed work for you? We are looking for your secret. (-: Please check question:

https://answers.splunk.com/answers/425146/simple-xml-dashboard-eval-strptime-using-old-value.html

Best Regards

0 Karma

masonmorales
Influencer

I'm not sure if you can perform an eval on a time token to convert it to another time format... I know that you can do this though:

 <input type="time" token="InputTime">
       <label>TimePicker for SourceType</label>
       <default>
         <earliest>-15m</earliest>
         <latest>now</latest>
       </default>
     </input>
   </fieldset>
   <row>
     <panel>
       <chart>
         <title>Day 1 - $InputTime.earliest$ to $InputTime.latest$</title>
0 Karma

KevinAdu
Explorer

Yeah but the issue is that will show it in the unix timestamp format. So I was hoping I could change it to make it more readable.

Where I saw the eval command being used that way was on this page:

http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/tokens

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...