Dashboards & Visualizations

Dynamically passing time-picker token in startime for "|gentimes"

egonstep
Path Finder

Hello all, I have a dashboard and I need the "|gentimes" command to generate dynamic values accordingly to the selected time picker. Picking up the earliest event from the search.

 | gentimes start=$field1.earliest$ increment=3h
 | convert timeformat="%Y/%m/%d - %H" ctime(starttime)
 | rename starttime as date
 | table date

I tried to search inside the start argument but It throws an error:

   [subsearch]: command="gentimes", generatetimestamps requires start=mm/dd/yyyy:hh:mm:ss and optional takes 'end' and  'increment' values

The full query (with gentimes error):

base search
| append
    [| gentimes start= [search "base search"
     | tail 1
     | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as dt
     | eval firstEvent = dt
     | return $firstEvent] increment=3h
 | convert timeformat="%Y/%m/%d - %H" ctime(starttime)
 | rename starttime as defaultDate
 | table defaultDate]

Thanks.

0 Karma

cmerriman
Super Champion

Make the subsearch in gentimes into a post process/base search and pass a token. I believe the reason it doesn't work is the way that it passes the argument.

<dashboard>
......
        <search>
         <query>"base search"
      | tail 1
      | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as dt
      | return $dt</query> 
          <done>
            <set token="token">$result.dt$</set>
          </done>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
  <row>
    <panel>
      <table>
        <search>
          <query>base search
 | append
     [| gentimes start=$token$  increment=3h| convert timeformat="%Y/%m/%d - %H" ctime(starttime)
  | rename starttime as defaultDate
  | table defaultDate]</query>
.........
</dashboard>
0 Karma

egonstep
Path Finder

@cmerriman Thanks for your response. But unfortunately, it throws another error:

[subsearch]: command='gentimes', invalid literal for int() with base 10: "$result.dt$"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...