Dashboards & Visualizations

Issue on Dropdown timepicker on Dashboard

iancorrea
Path Finder

I'm having problem on the eval part on join subsearch. When i run this search, I've got this result

"Error in 'eval' command: The expression is malformed. Expected )."

I'm using Dropdown on the dashboard as my timepicker so i have multiple tokens. Thanks

...//my base search//... earliest=$_emon$/$_eday$/$_eyear$:00:00:00 latest=$_lmon$/$_lday$/$_lyear$:23:59:59 

| join type=outer
        [
            search ...//another base search//... latest="+2mon" earliest=[| gentimes start=-1|eval new = relative_time($_emon$/$_eday$/$_eyear$:00:00:00 ,"-2228000")| return $new]

But when I'm using default time picker and use only one token $time.earliest$, my search is okay. Is the issue on this was having multiple tokens when selecting time? Thanks

0 Karma
1 Solution

elle118
Engager

Hi, @iancorrea

Let's check how to use the relative_time function.
You must specify UNIX time in the first argument.

https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/DateandTimeFunctions

For the problem you are facing, converting to UNIX time with strptime function first will give you the expected result.

ex)

| eval etime = strptime("$_emon$/$_eday$/$_eyear$:00:00:00", "%m/%d/%Y:%H:%M:%S")
| eval new = relative_time(etime,"-2228000")

View solution in original post

elle118
Engager

Hi, @iancorrea

Let's check how to use the relative_time function.
You must specify UNIX time in the first argument.

https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/DateandTimeFunctions

For the problem you are facing, converting to UNIX time with strptime function first will give you the expected result.

ex)

| eval etime = strptime("$_emon$/$_eday$/$_eyear$:00:00:00", "%m/%d/%Y:%H:%M:%S")
| eval new = relative_time(etime,"-2228000")

iancorrea
Path Finder

Thanks! This works the way I want it. 😄

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...