Is it possible to use regex on a token value ?

[venus699]

Hi Splunkers,
I'mm trying to use the var timeVar.earliest in this case -30d@d, in a panel that is actually a query that runs every time the dashboard is loaded. The query has fixed "time", but i would like to use the token timveVar.

this is my dropdown:

<input type="time" token="timeVar" searchWhenChanged="true">
  <label>Time Picker</label>
  <default>
    <earliest>-30d@d</earliest>
    <latest>now</latest>
  </default>
</input>

panel example:

| dbxquery query=" select foo from kaa where blaa and end_time >= sysdate - 20"

this "sysdate -20" i would like to be "sysdate - $timeVar.earliest$"
but for that to happen i need to somehow extract just the numbers from the token so when the search runs is this:

| dbxquery query="select foo from kaa where blaa and end_time >= sysdate - 30 "

but not this

| dbxquery query="select foo from kaa where blaa and end_time >= sysdate - -30d@d"

im out of ideas. regex would make but i dont see a working away.

Cheers

[woodcock]

Yes, you can use the match and replace functions with an EVAL-based token setting command.

[niketn · Accepted solution]

@venus699, refer to my answer https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html, which gives two methods of getting earliest and latest epoch time from selected time in the Splunk Time Picker.

For your case once you have Earliest Time as Epoch time, you can get number of seconds between current time and epoch time by subtracting from now() and then divide by 24*60*60 to get seconds difference for using in dbxquery for PL-SQL (http://www.dba-oracle.com/t_date_math_manipulation.htm). Also If number of seconds is greater than one day then I have used an eval to round off seconds part.

Following is an example using dummy search with addinfo to get the earliest time selected in the time picker.

  <search>
    <query>| makeresults
    |  addinfo
    |  eval earliestTimeForSQL=(now()-info_min_time)/(24*60*60)
    |  eval earliestTimeForSQL=case(earliestTimeForSQL>1,round(earliestTimeForSQL),true(),earliestTimeForSQL)
    </query>
    <earliest>$timeVar.earliest$</earliest>
    <latest>$timeVar.latest$</latest>
    <done>
      <set token="tokEarliestTimeForSQL">$result.earliestTimeForSQL$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="timeVar" searchWhenChanged="true">
      <label>Time Picker</label>
      <default>
        <earliest>-30d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

Please try out and confirm.

[venus699]

Fixed my problem that way, really apreciate your answer 🙂

[niketn]

@venus699, pleas accept the answer if your issue is resolved 🙂