Dashboards & Visualizations

Is it possible to use regex on a token value ?

venus699
Explorer

Hi Splunkers,
I'mm trying to use the var timeVar.earliest in this case -30d@d, in a panel that is actually a query that runs every time the dashboard is loaded. The query has fixed "time", but i would like to use the token timveVar.

this is my dropdown:

<input type="time" token="timeVar" searchWhenChanged="true">
  <label>Time Picker</label>
  <default>
    <earliest>-30d@d</earliest>
    <latest>now</latest>
  </default>
</input>

panel example:

| dbxquery query=" select foo from kaa where blaa and end_time >= sysdate - 20"

this "sysdate -20" i would like to be "sysdate - $timeVar.earliest$"
but for that to happen i need to somehow extract just the numbers from the token so when the search runs is this:

| dbxquery query="select foo from kaa where blaa and end_time >= sysdate - 30 "

but not this

| dbxquery query="select foo from kaa where blaa and end_time >= sysdate - -30d@d"

im out of ideas. regex would make but i dont see a working away.

Cheers

0 Karma
1 Solution

niketn
Legend

@venus699, refer to my answer https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html, which gives two methods of getting earliest and latest epoch time from selected time in the Splunk Time Picker.

For your case once you have Earliest Time as Epoch time, you can get number of seconds between current time and epoch time by subtracting from now() and then divide by 24*60*60 to get seconds difference for using in dbxquery for PL-SQL (http://www.dba-oracle.com/t_date_math_manipulation.htm). Also If number of seconds is greater than one day then I have used an eval to round off seconds part.

Following is an example using dummy search with addinfo to get the earliest time selected in the time picker.

  <search>
    <query>| makeresults
    |  addinfo
    |  eval earliestTimeForSQL=(now()-info_min_time)/(24*60*60)
    |  eval earliestTimeForSQL=case(earliestTimeForSQL>1,round(earliestTimeForSQL),true(),earliestTimeForSQL)
    </query>
    <earliest>$timeVar.earliest$</earliest>
    <latest>$timeVar.latest$</latest>
    <done>
      <set token="tokEarliestTimeForSQL">$result.earliestTimeForSQL$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="timeVar" searchWhenChanged="true">
      <label>Time Picker</label>
      <default>
        <earliest>-30d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

woodcock
Esteemed Legend

Yes, you can use the match and replace functions with an EVAL-based token setting command.

niketn
Legend

@venus699, refer to my answer https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html, which gives two methods of getting earliest and latest epoch time from selected time in the Splunk Time Picker.

For your case once you have Earliest Time as Epoch time, you can get number of seconds between current time and epoch time by subtracting from now() and then divide by 24*60*60 to get seconds difference for using in dbxquery for PL-SQL (http://www.dba-oracle.com/t_date_math_manipulation.htm). Also If number of seconds is greater than one day then I have used an eval to round off seconds part.

Following is an example using dummy search with addinfo to get the earliest time selected in the time picker.

  <search>
    <query>| makeresults
    |  addinfo
    |  eval earliestTimeForSQL=(now()-info_min_time)/(24*60*60)
    |  eval earliestTimeForSQL=case(earliestTimeForSQL>1,round(earliestTimeForSQL),true(),earliestTimeForSQL)
    </query>
    <earliest>$timeVar.earliest$</earliest>
    <latest>$timeVar.latest$</latest>
    <done>
      <set token="tokEarliestTimeForSQL">$result.earliestTimeForSQL$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="timeVar" searchWhenChanged="true">
      <label>Time Picker</label>
      <default>
        <earliest>-30d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

Please try out and confirm.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

venus699
Explorer

Fixed my problem that way, really apreciate your answer 🙂

0 Karma

niketn
Legend

@venus699, pleas accept the answer if your issue is resolved 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...