I have a requirement to display in a dashboard the time range in use by the time picker. This has to be a single value in a specific format. To accomplish this I've been using the strftime function, which requires that I have tokens in epoch time from the dashboard.
To accomplish this I've been using @rjthibod solution from https://answers.splunk.com/answers/590512/use-timepicker-earliest-and-latest-as-epoch-time.html. This uses the relative_time function within the input to conditionally convert the time picker tokens into epoch time if they aren't already. But today I am seeing strange behavior from some time ranges, specifically "Previous Business Week".
Everything works fine for time ranges like "Previous Month", but when I change the time picker to "Previous Business Week" I get an ending epoch time from the time picker that is in the future. This isn't the result that I get when I use the relative_time function in an eval statement in a regular search, as displayed in the table below the single-value panel.
Sorry for the long xml, but I think this shows all of the different tokens and evals in play.
Run-anywhere example:
<form>
<label>time picker epoch issue</label>
<description></description>
<fieldset submitButton="false">
<input type="time" token="timepicker">
<label>Select Time Range</label>
<default>
<earliest>-1mon@mon</earliest>
<latest>@mon</latest>
</default>
<change>
<eval token="timepicker.earliest_epoch">if(isnum('earliest'),'earliest',relative_time(now(),'earliest')</eval>
<eval token="timepicker.latest_epoch">if(isnum('latest'),'latest',relative_time(now(),'latest')</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<title>$timepicker.earliest_epoch$ through $timepicker.latest_epoch$ OR $timepicker.earliest$ through $timepicker.latest$</title>
<single>
<search>
<query>| makeresults
| eval earliest = strftime("$timepicker.earliest_epoch$", "%d %b %Y")
| eval latest = strftime("$timepicker.latest_epoch$", "%d %b %Y")
| eval display = earliest." - ".latest
| table display</query>
</search>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<table>
<search>
<query>|makeresults
|eval 'timepicker.earliest'="$timepicker.earliest$"
|eval 'timepicker.latest'="$timepicker.latest$"
|eval 'timepicker.earliest_epoch'="$timepicker.earliest_epoch$"
|eval 'timepicker.latest_epoch'="$timepicker.latest_epoch$"
| eval earliest_from_rel_time = relative_time(now(), "$timepicker.earliest$")
| eval latest_from_rel_time = relative_time(now(), "$timepicker.latest$")
| eval pretty_latest_from_rel_time = strftime(latest_from_rel_time, "%d %b %Y")
| eval earliest_from_epoch = strftime("$timepicker.earliest_epoch$", "%d %b %Y")
| eval latest_from_epoch = strftime("$timepicker.latest_epoch$", "%d %b %Y")
| table 'timepicker.earliest' 'timepicker.latest' 'timepicker.earliest_epoch' 'timepicker.latest_epoch' earliest_from_rel_time latest_from_rel_time pretty_latest_from_rel_time earliest_from_epoch latest_from_epoch</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<html>
|eval 'timepicker.earliest'="$$timepicker.earliest$$"<br/>
|eval 'timepicker.latest'="$$timepicker.latest$$"<br/>
|eval 'timepicker.earliest_epoch'="$$timepicker.earliest_epoch$$"<br/>
|eval 'timepicker.latest_epoch'="$$timepicker.latest_epoch$$"<br/>
| eval earliest_from_rel_time = relative_time(now(), "$$timepicker.earliest$$")<br/>
| eval latest_from_rel_time = relative_time(now(), "$$timepicker.latest$$")<br/>
| eval pretty_latest_from_rel_time = strftime(latest_from_rel_time, "%d %b %Y")<br/>
| eval earliest_from_epoch = strftime("$$timepicker.earliest_epoch$$", "%d %b %Y") <br/>
| eval latest_from_epoch = strftime("$$timepicker.latest_epoch$$", "%d %b %Y")
</html>
</panel>
</row>
</form>
... View more