- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- $selection.earliest$ time formatting
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
$selection.earliest$ time formatting
I am using a 'zoom' feature within the simplified XML, and I have it working. I am simply attempting to reformat the
$selection.earliest$ and $selection.latest$ to human readable time instead of EPOCH time in order to stick it in the title of the XML panel.
Can that be done, or maybe there is another field(s) I can use to display human readable time?
Thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@dolivasoh, @pamcarvalho, Use the <eval> tag to convert $start$ and $end$ selection times to String time using strftime() function:
<selection>
...
...
...
<eval token="selEarlStr">strftime($start$,"%Y/%m/%d %H:%M:%S %p")</eval>
<eval token="selLatStr">strftime($end$,"%Y/%m/%d %H:%M:%S %p")</eval>
</selection>
Then use the $selEarlStr$ and $selLatStr$ tokens to display selected time in String format.
<html>
...
...
<code>New Selected Time Range (String): $selEarlStr$ - $selLatStr$</code>
...
</html>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use convert() to achieve this.
Syntax
convert timeformat=string...
Required arguments
Syntax: auto() | ctime() | dur2sec() | memk() | mktime() | mstime() | none() | num() | rmcomma() | rmunit()
Description: Functions for convert.
ctime()
Syntax: ctime(
Description: Convert an epoch time to an ascii human readable time. Use the timeformat option to specify exact format to convert to.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This would need to be done in a dashboard panel 'title' screen. I'm not running a search there unfortunately.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any solution for this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
l know it has been 2 years, but does anyone know how to do that? I am using drilldown to get data value, but when I put the value as the title, it is in Epoch, and I need it to be in human format in the table.. Can anyone help me with that?
Get the T-shirt to Prove You Survived Splunk University Bootcamp
Introducing the Splunk Community Dashboard Challenge!
Wondering How to Build Resiliency in the Cloud?
