In Splunk 4.3.2, I used the variable $search.timeR...

rakesh_498115 · ‎06-29-2016

Hi All,

Is there any equivalent variable for this in Splunk 6.4.0?

$search.timeRange.label$

I have used the above variable to display the selected time label, but I'm looking for any equivalent with the new Splunk version we are using. of course i have come across to use to earliest and latest separately in 6.4.0, but couldn't actually get the label name displayed.

i.e able to get something like this:

selected Time is **-7d@d and now** in SPLUNK 6.4.0

whereas earlier in SPLUNK 4.3.2, I used to get:

selected Time **Last 7 days**

How can we get this back again?

Many thanks,
Rakesh.

aljohnson_splun · ‎06-29-2016

Here is what you want:

<form>
  <label>test</label>
  <fieldset submitButton="true">
    <input type="time" token="time">
      <change>
        <set token="time_label">$label$</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
         the time_label token is: $time_label$
        &lt;br/&gt;
        the time.earliest token is: $time.earliest$
        &lt;br/&gt;
        the time.latest token is: $time.latest$
      </html>
    </panel>
  </row>
</form>

rakesh_498115 · ‎06-30-2016

Thanks a lot alijohson..its working like a charm !!! 🙂

rakesh_498115 · ‎06-30-2016

alijohnson on the initial load of the form can we get the label printed ... Cause until i change the timepicker value label was not disaplaying ..is there a way to display the label on form load ??? i.e show the default value of timepicker in the label in the form load. ??

aljohnson_splun · ‎07-14-2016

Hi @Rakesh_498115 - please mark this answer as "accepted" if this solved your problem.

And yes - you can specify what you'd like the default value of the token to be. Here is an example:

<input type="dropdown" token="sourcetype_tok">
  <label>Select a source type</label>
  <default>splunkd</default>
  <choice value="splunkd">splunkd</choice>
  <choice value="splunk_web_access">splunk_web_access</choice>
  <choice value="splunkd_ui_access">splunkd_ui_access</choice>
</input>

In Splunk 4.3.2, I used the variable $search.timeRange.label$. Is there any equivalent value for this in 6.4.0?

Wondering How to Build Resiliency in the Cloud?

Updated Data Management and AWS GDI Inventory in Splunk Observability

Introducing the Splunk Community Dashboard Challenge!