Splunk Search

How to replace "T" with a blank space for time input fields in a text input form?

purva13
Explorer

Hello,

I am trying queries in Splunk and learning it. I have a dashboard where there are two text inputs, From and To, where a user will enter time like this:
alt text

And I am passing it to earliestTime and latestTime like this:

<earliestTime>$from$</earliestTime>
<latestTime>$to$</latestTime>

Now, instead of T, I want a blank space. How can I do this?
I tried to use eval replace function, but that is not working.

[I don't want to use time-picker of Splunk.]

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can set up an eval-based macro like this:

[my_strptime(1)]
args = time
definition = strptime("$time$", "%F %T")
iseval = 1

Then drop the earliest and latest elements from your search element and instead specify the time range directly in the search:

index=foo earliest=`my_strptime($from$)` latest=`my_strptime($to$)`

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can set up an eval-based macro like this:

[my_strptime(1)]
args = time
definition = strptime("$time$", "%F %T")
iseval = 1

Then drop the earliest and latest elements from your search element and instead specify the time range directly in the search:

index=foo earliest=`my_strptime($from$)` latest=`my_strptime($to$)`

purva13
Explorer

Hey martin_mueller,

I tried this few days back and did't work. I was wondering what went wrong., it seems my macro was private. I worked perfect. Thanks a lot for the help!

0 Karma

purva13
Explorer

I think I am not precise in my question. Instead of T in the time entered, I want a blank space so that it will be more convenient for the user. But when I do that, it is not accepting that time. Besides, I used strptime and strftime with eval, but I am not getting how can I pass it in ealiestTime and latestTime.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...