Dashboards & Visualizations

On dashboards with a time range picker, how can I access the start/end times as Unix epoch values?

responsys_cm
Builder

I would like to be able for users to use a time range picker on a dashboard and then be able to feed those start/end times to a script further in the pipeline. How do I go about doing that?

Thanks.

Craig

Tags (1)

sideview
SplunkTrust
SplunkTrust

If by "further in the pipeline" you mean further down in the search language, then you want to look at the addinfo command. addinfo will add some fields to every row of the incoming results, and notable among them are two fields in particular: info_max_time, which will be the absolute epochtime value of the timerange's end-time, and info_min_time, which will be the same but for the timerange's start time. You can then use these like any other field.

addinfo will give you those values as epochtimes, no matter whether the user's selected timerange is a relative timerange or an absolute one.

If by pipeline you mean the view xml, then I'd probably use addinfo and then use a little PostProcess and a Sideview ResultsValueSetter module to pull those field values down to the client so as to use them in another search, or as arguments to something. There is however also $search.timeRange.earliest$ and $search.timeRange.latest$ that is added by Sideview Utils, and this can be quite useful. However not that if the user's selected timerange is a relative timerange, then these values will simply be the relative values - not the absolute equivalents that you would get from the addinfo command.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...