Dashboards & Visualizations

Invalid Date using Job in the UI

sangs8788
Communicator

@niketn 

I am trying to display the selected start and end time in the UI. I followed particularly the below answer given by you. 

https://community.splunk.com/t5/Dashboards-Visualizations/Setting-job-earliestTime-and-job-latestTim...

It was working fine but suddenly it stopped saying Invalid Date. We recently had a splunk Upgrade to Version:8.0.4.1. Could it be due to the upgrade? Was there any change. I couldnt narrow down to exact issue.

Here is the code which you have shared

 

<form>
  <label>Show Time from Time Picker</label>
  <!-- Dummy search to pull selected time range earliest and latest date/time -->
  <search>
    <query>| makeresults | addinfo </query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    <done>
      <eval token="tokEarliestTime">strftime(strptime('$job.earliestTime$',"%Y/%m/%dT%H:%M:%S.%3N %p"),"%m/%d/%y %I:%M:%S.%3N %p")</eval>
      <eval token="tokLatestTime">strftime(strptime('$job.latestTime$',"%Y/%m/%dT%H:%M:%S.%3N %p"),"%m/%d/%y %I:%M:%S.%3N %p")</eval>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <!-- sample HTML Panel to display results in required format -->
      <html>
        (  $tokEarliestTime$ to $tokLatestTime$)
      </html>
    </panel>
  </row>
</form>

 

Attaching the screenshot of what is shown in the UI. Could you please suggest. 

Labels (2)
Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sangs8788 

Try this,

<form>
  <label>Show Time from Time Picker</label>
  <!-- Dummy search to pull selected time range earliest and latest date/time -->
  <search>
    <query>| makeresults | addinfo</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    <done>
      <eval token="tokEarliestTime">strftime($result.info_min_time$,"%Y/%m/%dT%H:%M:%S.%3N %p")</eval>
      <eval token="tokLatestTime">strftime($result.info_max_time$,"%Y/%m/%dT%H:%M:%S.%3N %p")</eval>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    
  </fieldset>
  <row>
    <panel>
      <!-- sample HTML Panel to display results in required format -->
      <html>
        (  $tokEarliestTime$ to $tokLatestTime$)
      </html>
    </panel>
  </row>
</form>

 

Screenshot 2021-07-19 at 5.05.52 PM.png

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sangs8788 

Try this,

<form>
  <label>Show Time from Time Picker</label>
  <!-- Dummy search to pull selected time range earliest and latest date/time -->
  <search>
    <query>| makeresults | addinfo</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
    <done>
      <eval token="tokEarliestTime">strftime($result.info_min_time$,"%Y/%m/%dT%H:%M:%S.%3N %p")</eval>
      <eval token="tokLatestTime">strftime($result.info_max_time$,"%Y/%m/%dT%H:%M:%S.%3N %p")</eval>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    
  </fieldset>
  <row>
    <panel>
      <!-- sample HTML Panel to display results in required format -->
      <html>
        (  $tokEarliestTime$ to $tokLatestTime$)
      </html>
    </panel>
  </row>
</form>

 

Screenshot 2021-07-19 at 5.05.52 PM.png

Thanks
KV
▄︻̷̿┻̿═━一   ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

sangs8788
Communicator

This works. Thanks for looking into this.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Hi

Replace the eval lines with this ones:

<eval token="tokEarliestTime">strftime(strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m/%d/%y %I:%M:%S.%3N %p")</eval>
<eval token="tokLatestTime">strftime(strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m/%d/%y %I:%M:%S.%3N %p")</eval>

 

Also, I'm sad to say that Niket is no longer with us. He passed away last year.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

sangs8788
Communicator

This doesnt work either

0 Karma

sangs8788
Communicator

I am so sorry hear that. I didnt know. May his soul rest in peace. Didnt expect

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...