Splunk Search

Convert epoch time from drilldown parameter

feickertmd
Communicator

I have set up a drilldown to jump from a timechart graph to another dashboard.

<link>
<![CDATA[
/app/SPSearchData/drilldown_search_and_results?status=$click.name2$&earliest=$earliest$&latest=$latest$
]]>
</link>
</drilldown>

The resulting URL for the target dashboard displays like this:
/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1395205200&latest=1395810000#en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=1395205200&latest=1395810000

Note that the earliest and latest params are set to Epoch time. I would like to have a HTML label above the chart that uses tokens to update ("$status$ from $earliest$ to $latest$"). My problem is that it comes up like:
Abandoned searches from 1395205200 to 1395810000

Is there any way I can format those epoch timestamps to be able to display them to the user in a readable format?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could add a time range picker and feed your tokens into that, that way the user can both see the time range (to some degree) and manipulate it as well.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could add a time range picker and feed your tokens into that, that way the user can both see the time range (to some degree) and manipulate it as well.

martin_mueller
SplunkTrust
SplunkTrust

You can save yourself some customization if you leave off the custom token name for the time input... assuming that's the only time range picker on the dashboard.

0 Karma

feickertmd
Communicator

I tried that with this:

<input type="time" token="time_token">
<label />
<default>
<earliestTime>$earliest$</earliestTime>
<latestTime >$latest$</latestTime>
</default>
</input>

I had done that, but I realize now that I had to redefine how I was passing tokens. I was getting
http://apsrd3084:8000/en-US/app/SPSearchData/drilldown_search_and_results?status=Abandoned&earliest=...

I needed to change the sending form to send the tokens in the proper format.

Thanks again!

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...