Splunk Search

Converting @d for eval command

kunwarjit
Engager

I am trying to use the token passed through the time input in a dashboard to a search query. In this specific example, I am trying to do the following

|eval date=strptime($timepicker.latest$,"%H:%M")

If I select the default time as 'today' or 'yesterday', the value for timepicker is sent as @d and the eval command cannot extract the hour and minute, rather, it fails with the following

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '@d,"%H:%M")'. How can I pass through the timepicker token as a converted epoch formatted time.

Tags (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kunwarjit

Here I suggest to use addinfo search command. You will get time boundary as fields in epochtime. So you can use directly as per your need.

info_min_time : The earliest time boundary for the search.
info_max_time The latest time boundary for the search.

| makeresults | addinfo |eval date=strftime(info_max_time,"%H:%M")

https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Addinfo

Thanks

View solution in original post

woodcock
Esteemed Legend

Coincidentally enough, code was just posted for this a few days ago here (be sure to UpVote:
https://answers.splunk.com/answers/786365/can-some-one-explain-me-the-function-of-the-below.html#ans...

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kunwarjit

Here I suggest to use addinfo search command. You will get time boundary as fields in epochtime. So you can use directly as per your need.

info_min_time : The earliest time boundary for the search.
info_max_time The latest time boundary for the search.

| makeresults | addinfo |eval date=strftime(info_max_time,"%H:%M")

https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Addinfo

Thanks

kunwarjit
Engager

Thanks, works like a charm!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...