I am using the following code in my dashboard
<search>
<query>| makeresults</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<done>
<eval token="tokTime">$job.earliestTime$</eval>
<eval token="tokEarliestTime">strftime(strptime($job.earliestTime$,"%Y/%m/%dT%H:%M:%S %p"),"%m/%d/%y %I:%M:%S %p")
</eval>
<eval token="tokLatestTime">strftime(strptime($job.latestTime$,"%Y/%m/%dT%H:%M:%S %p"),"%m/%d/%y %I:%M:%S %p")</eval>
</done>
</search>
In my panel, i use this
<title>from $tokEarliestTime$ to $tokLatestTime$</title>
When I save my dashboard it shows up as
from invalid date to invalid date
Do I need to change any personal settings in splunk to get this working ?
Hi
Try this
<form>
<label>date</label>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>from $tokEarliest$ to $tokLatest$</title>
<table>
<search>
<query>| makeresults</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<done>
<eval token="tokTime">$job.earliestTime$</eval>
<eval token="tokEarliest">strftime(strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m/%d/%y %I:%M:%S %p")</eval>
<eval token="tokLatest">strftime(strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z"),"%m/%d/%y %I:%M:%S %p")</eval>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
Try this:
<search>
<query>| makeresults</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<done>
<eval token="tokTime">$job.earliestTime$</eval>
<eval token="tokEarliestTime">strftime($job.earliestTime$,"%Y/%m/%dT%H:%M:%S %p")</eval>
<eval token="tokLatestTime">strftime($job.latestTime$,"%Y/%m/%dT%H:%M:%S %p")</eval>
</done>
And then this:
<title>from $tokEarliestTime$ to $tokLatestTime$</title>
Same issue as before. it says invalid date in the dashboard.
Sounds like some server side settings that need to change ?