Getting Data In

Why are dependent dynamic drop-down inputs displaying epoch time values instead of the format HH:MM in Simple XML?

tdiestel
Path Finder

Hi All;

3 Drop down inputs right now are being used as a custom timepicker. The first one is used to select any of the past 7 days. It displays the date and then passes the epoch time for the date selected to the other 2 prompts. The other 2 drop downs then take the epoch value and inserts it into the search query and creates a time aspect to the date selected. When everything works great it looks like this:

alt text

Now the problem rises when i then go to change the date to let's say "February 24", the From and To prompts then for some reason display the Epoch value instead of the display labels, and the Epoch Value is not passed to the rest of the panels in the dashboard:

alt text

But when I the select values for the From and To prompts everything acts as it should.

Has anyone had a similar problem like this and knows if it can be fixed? Any help is greatly appreciated.

Thanks,
Tyler

Also, here is my lengthy code for the inputs:

<input type="dropdown" token="date" searchWhenChanged="true">
  <label>Select a Date</label>
  <search>
    <query>|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-86400 |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(2*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(3*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(4*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(5*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(6*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(7*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]| table time dateadded_epoch</query>
    <earliest>0</earliest>
  </search>
  <fieldForLabel>time</fieldForLabel>
  <fieldForValue>dateadded_epoch</fieldForValue>
  <choice value="0| eval time=strftime(now(),&quot;%Y %B %d&quot;) |fields time | eval dateadded_epoch=strptime(time, &quot;%Y %B %d&quot;)|dedup time dateadded_epoch| eval time_of_day=dateadded_epoch">Today</choice>
  <default>0| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=dateadded_epoch</default>
</input>
<input type="dropdown" token="earliest_test" searchWhenChanged="true">
  <label>From:</label>
  <search>
    <query>|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$|eval display_time="00:00"|append[|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+3600|eval display_time="01:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(2*3600)|eval display_time="02:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(3*3600)|eval display_time="03:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(4*3600)|eval display_time="04:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(5*3600)|eval display_time="05:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(6*3600)|eval display_time="06:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(7*3600)|eval display_time="07:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(8*3600)|eval display_time="08:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(9*3600)|eval display_time="09:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(10*3600)|eval display_time="10:00"] | append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(11*3600)|eval display_time="11:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(12*3600)|eval display_time="12:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(13*3600)|eval display_time="13:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(14*3600)|eval display_time="14:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(15*3600)|eval display_time="15:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(16*3600)|eval display_time="16:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(17*3600)|eval display_time="17:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(18*3600)|eval display_time="18:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(19*3600)|eval display_time="19:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(20*3600)|eval display_time="20:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(21*3600)|eval display_time="21:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(22*3600)|eval display_time="22:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(23*3600)|eval display_time="23:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(24*3600)-1|eval display_time="23:59"]| fields display_time time_of_day</query>
  </search>
  <fieldForLabel>display_time</fieldForLabel>
  <fieldForValue>time_of_day</fieldForValue>
</input>
<input type="dropdown" token="latest_test" searchWhenChanged="true">
  <label>To:</label>
  <search>
    <query>|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$|eval display_time="00:00"|append[|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+3600|eval display_time="01:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(2*3600)|eval display_time="02:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(3*3600)|eval display_time="03:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(4*3600)|eval display_time="04:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(5*3600)|eval display_time="05:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(6*3600)|eval display_time="06:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(7*3600)|eval display_time="07:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(8*3600)|eval display_time="08:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(9*3600)|eval display_time="09:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(10*3600)|eval display_time="10:00"] | append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(11*3600)|eval display_time="11:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(12*3600)|eval display_time="12:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(13*3600)|eval display_time="13:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(14*3600)|eval display_time="14:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(15*3600)|eval display_time="15:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(16*3600)|eval display_time="16:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(17*3600)|eval display_time="17:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(18*3600)|eval display_time="18:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(19*3600)|eval display_time="19:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(20*3600)|eval display_time="20:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(21*3600)|eval display_time="21:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(22*3600)|eval display_time="22:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(23*3600)|eval display_time="23:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(24*3600)-1|eval display_time="23:59"]| fields display_time time_of_day</query>
  </search>
  <fieldForLabel>display_time</fieldForLabel>
  <fieldForValue>time_of_day</fieldForValue>
</input>
1 Solution

tdiestel
Path Finder

Ok i tried a ton of different things, but what finally did it for me was Adding in a "Submit" button. Now everything is working as expected, and i never even have to hit the submit button too. it just seems to work.

If anyone else runs into this issue, try this. It can be added by going to "Add Inputs" and then click "Submit"

-Tyler

View solution in original post

tdiestel
Path Finder

Ok i tried a ton of different things, but what finally did it for me was Adding in a "Submit" button. Now everything is working as expected, and i never even have to hit the submit button too. it just seems to work.

If anyone else runs into this issue, try this. It can be added by going to "Add Inputs" and then click "Submit"

-Tyler

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...