All Apps and Add-ons

$selection.earliest$ time formatting

tmarlette
Motivator

I am using a 'zoom' feature within the simplified XML, and I have it working. I am simply attempting to reformat the
$selection.earliest$ and $selection.latest$ to human readable time instead of EPOCH time in order to stick it in the title of the XML panel.

Can that be done, or maybe there is another field(s) I can use to display human readable time?

Thank you!

0 Karma

niketn
Legend

@dolivasoh, @pamcarvalho, Use the <eval> tag to convert $start$ and $end$ selection times to String time using strftime() function:

       <selection>
            ...
            ...
            ...
            <eval token="selEarlStr">strftime($start$,"%Y/%m/%d %H:%M:%S %p")</eval>
            <eval token="selLatStr">strftime($end$,"%Y/%m/%d %H:%M:%S %p")</eval>
       </selection>

Then use the $selEarlStr$ and $selLatStr$ tokens to display selected time in String format.

    <html>
        ...
        ...
        <code>New Selected Time Range (String): $selEarlStr$ - $selLatStr$</code>
        ...
    </html>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

dolivasoh
Contributor

You can use convert() to achieve this.

Syntax

convert timeformat=string...
Required arguments

Syntax: auto() | ctime() | dur2sec() | memk() | mktime() | mstime() | none() | num() | rmcomma() | rmunit() 
Description: Functions for convert. 

ctime()
Syntax: ctime()
Description: Convert an epoch time to an ascii human readable time. Use the timeformat option to specify exact format to convert to.

0 Karma

tmarlette
Motivator

This would need to be done in a dashboard panel 'title' screen. I'm not running a search there unfortunately.

0 Karma

kasu_praveen
Communicator

Any solution for this?

0 Karma

pamcarvalho
Path Finder

l know it has been 2 years, but does anyone know how to do that? I am using drilldown to get data value, but when I put the value as the title, it is in Epoch, and I need it to be in human format in the table.. Can anyone help me with that?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...