Getting Data In

Why are dependent dynamic drop-down inputs displaying epoch time values instead of the format HH:MM in Simple XML?

tdiestel
Path Finder

Hi All;

3 Drop down inputs right now are being used as a custom timepicker. The first one is used to select any of the past 7 days. It displays the date and then passes the epoch time for the date selected to the other 2 prompts. The other 2 drop downs then take the epoch value and inserts it into the search query and creates a time aspect to the date selected. When everything works great it looks like this:

alt text

Now the problem rises when i then go to change the date to let's say "February 24", the From and To prompts then for some reason display the Epoch value instead of the display labels, and the Epoch Value is not passed to the rest of the panels in the dashboard:

alt text

But when I the select values for the From and To prompts everything acts as it should.

Has anyone had a similar problem like this and knows if it can be fixed? Any help is greatly appreciated.

Thanks,
Tyler

Also, here is my lengthy code for the inputs:

<input type="dropdown" token="date" searchWhenChanged="true">
  <label>Select a Date</label>
  <search>
    <query>|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-86400 |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(2*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(3*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(4*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(5*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(6*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]|append[|inputlookup Events_Lookup_20141001.csv|eval past_time=now()-(7*86400) |eval time=strftime(past_time,"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch]| table time dateadded_epoch</query>
    <earliest>0</earliest>
  </search>
  <fieldForLabel>time</fieldForLabel>
  <fieldForValue>dateadded_epoch</fieldForValue>
  <choice value="0| eval time=strftime(now(),&quot;%Y %B %d&quot;) |fields time | eval dateadded_epoch=strptime(time, &quot;%Y %B %d&quot;)|dedup time dateadded_epoch| eval time_of_day=dateadded_epoch">Today</choice>
  <default>0| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=dateadded_epoch</default>
</input>
<input type="dropdown" token="earliest_test" searchWhenChanged="true">
  <label>From:</label>
  <search>
    <query>|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$|eval display_time="00:00"|append[|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+3600|eval display_time="01:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(2*3600)|eval display_time="02:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(3*3600)|eval display_time="03:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(4*3600)|eval display_time="04:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(5*3600)|eval display_time="05:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(6*3600)|eval display_time="06:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(7*3600)|eval display_time="07:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(8*3600)|eval display_time="08:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(9*3600)|eval display_time="09:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(10*3600)|eval display_time="10:00"] | append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(11*3600)|eval display_time="11:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(12*3600)|eval display_time="12:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(13*3600)|eval display_time="13:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(14*3600)|eval display_time="14:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(15*3600)|eval display_time="15:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(16*3600)|eval display_time="16:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(17*3600)|eval display_time="17:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(18*3600)|eval display_time="18:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(19*3600)|eval display_time="19:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(20*3600)|eval display_time="20:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(21*3600)|eval display_time="21:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(22*3600)|eval display_time="22:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(23*3600)|eval display_time="23:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(24*3600)-1|eval display_time="23:59"]| fields display_time time_of_day</query>
  </search>
  <fieldForLabel>display_time</fieldForLabel>
  <fieldForValue>time_of_day</fieldForValue>
</input>
<input type="dropdown" token="latest_test" searchWhenChanged="true">
  <label>To:</label>
  <search>
    <query>|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$|eval display_time="00:00"|append[|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+3600|eval display_time="01:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(2*3600)|eval display_time="02:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(3*3600)|eval display_time="03:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(4*3600)|eval display_time="04:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(5*3600)|eval display_time="05:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(6*3600)|eval display_time="06:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(7*3600)|eval display_time="07:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(8*3600)|eval display_time="08:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(9*3600)|eval display_time="09:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(10*3600)|eval display_time="10:00"] | append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(11*3600)|eval display_time="11:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(12*3600)|eval display_time="12:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(13*3600)|eval display_time="13:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(14*3600)|eval display_time="14:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(15*3600)|eval display_time="15:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(16*3600)|eval display_time="16:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(17*3600)|eval display_time="17:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(18*3600)|eval display_time="18:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(19*3600)|eval display_time="19:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(20*3600)|eval display_time="20:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(21*3600)|eval display_time="21:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(22*3600)|eval display_time="22:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(23*3600)|eval display_time="23:00"]| append [|inputlookup Events_Lookup_20141001.csv| eval time=strftime(now(),"%Y %B %d") |fields time | eval dateadded_epoch=strptime(time, "%Y %B %d")|dedup time dateadded_epoch| eval time_of_day=$date$+(24*3600)-1|eval display_time="23:59"]| fields display_time time_of_day</query>
  </search>
  <fieldForLabel>display_time</fieldForLabel>
  <fieldForValue>time_of_day</fieldForValue>
</input>
1 Solution

tdiestel
Path Finder

Ok i tried a ton of different things, but what finally did it for me was Adding in a "Submit" button. Now everything is working as expected, and i never even have to hit the submit button too. it just seems to work.

If anyone else runs into this issue, try this. It can be added by going to "Add Inputs" and then click "Submit"

-Tyler

View solution in original post

tdiestel
Path Finder

Ok i tried a ton of different things, but what finally did it for me was Adding in a "Submit" button. Now everything is working as expected, and i never even have to hit the submit button too. it just seems to work.

If anyone else runs into this issue, try this. It can be added by going to "Add Inputs" and then click "Submit"

-Tyler

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...