Hello all,
I am designing a dashboard that will use a timer pick to build search. I would like to show in the panel title the time in the same format as any Search:
7/6/17 9:00:00.000 AM to 7/13/17 9:19:00.000 AM
But when I add the timer in the title I am getting the "snap to time" format:
Between $timer.earliest$ and $timer.latest$
=
Between -7d@h and now
Is there anyway I can format it to string? I tried feel combinations, but they didn't work:
1st:
<row>
<panel>
<title>Select Desired Time of oom-killer Invocation</title>
<table>
<title>Between strftime($timer.earliest$,"%c") and strftime($timer.latest$,"%c")</title>
<search>
Output:
Between strftime(-7d@h,"%c") and strftime(now,"%c")
2nd:
<input type="time" token="timer" searchWhenChanged="true">
<label>Timeframe</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
<change>
<unset token="SearchHost"></unset>
<unset token="tssnservice"></unset>
<eval token="searliest">strftime(earliest,"%c")</eval>
<eval token="slatest">strftime(latest,"%c")</eval>
</change>
</input>
...
<table>
<title>Between $searliest$ and $slatest$</title>
<search>
...
OUTPUT:
Between Invalid date and Invalid date
and...
<input type="time" token="timer" searchWhenChanged="true">
<label>Timeframe</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
<change>
<unset token="SearchHost"></unset>
<unset token="tssnservice"></unset>
<eval token="searliest">'strftime(earliest,"%c")'</eval>
<eval token="slatest">'strftime(latest,"%c")'</eval>
</change>
</input>
...
<table>
<title>Between $searliest$ and $slatest$</title>
<search>
...
OUTPUT:
Between $searliest$ and $slatest$
Is there any other option?
Thank you,
Gerson
Second attempt...
We need to check if the timepicker variable is an Epoch number or a Splunk artifact like “-7d@d” or “now”.
If the variable is an Epoch number, we convert it to a date using strftime.
If the variable is a String, we need to convert it into an Epoch number using relative_time, then into a date.
<earliest>$command_token.earliest$</earliest>
<latest>$command_token.latest$</latest>
<progress>
<eval token="allCommandsEarliestLabel">
if(isnum($command_token.earliest$),strftime($command_token.earliest$,"%d/%m/%Y %H:%M:%S"),strftime(relative_time(now(), $command_token.earliest$),"%m/%d/%Y %H:%M:%S"))
</eval>
<eval token="allCommandsLatestLabel">
if(isnum($command_token.latest$),strftime($command_token.latest$,"%m/%d/%Y %H:%M:%S"),strftime(relative_time(now(), "@sec"),"%m/%d/%Y %H:%M:%S"))
</eval>
</progress>
First attempt...
<title>All Commands Last from $allCommandsEarliestLabel$ to $allCommandsLatestLabel$</title>
<chart id="allCommandMaster">
<search id="passBaseSearch">
<query>index=...|stats count by command</query>
<earliest>$command_token.earliest$</earliest>
<latest>$command_token.latest$</latest>
<progress>
<eval token="allCommandsEarliestLabel">if(isnum($command_token.earliest$),strftime($command_token.earliest$,"%d/%m/%Y %H:%M:%S"),$command_token.earliest$)</eval>
<eval token="allCommandsLatestLabel">if(isnum($command_token.latest$),strftime($command_token.latest$,"%d/%m/%Y %H:%M:%S"),$command_token.latest$)</eval>
</progress>
</search>
No, that is not what the timer pick sets. it sets 2 variables:
<earliest>-7d@h</earliest>
<latest>now</latest>
The provided code works for dropdown lists.
Thank you,
<label>Time Range:</label>
<default>
<earliestTime>-1d@d</earliestTime>
<latestTime>@d</latestTime>
</default>
<change>
<!-- use predefined input tokens to set -->
<!-- tokens for the selected label and value -->
<set token="date_label">$label$</set>
<set token="earliest_tok">$value$</set>
</change>