Re: In Splunk 4.3.2, I used the variable $search.t...

rakesh_498115 · ‎06-29-2016

Hi All,

Is there any equivalent variable for this in Splunk 6.4.0?

$search.timeRange.label$

I have used the above variable to display the selected time label, but I'm looking for any equivalent with the new Splunk version we are using. of course i have come across to use to earliest and latest separately in 6.4.0, but couldn't actually get the label name displayed.

i.e able to get something like this:

selected Time is **-7d@d and now** in SPLUNK 6.4.0

whereas earlier in SPLUNK 4.3.2, I used to get:

selected Time **Last 7 days**

How can we get this back again?

Many thanks,
Rakesh.

aljohnson_splun · ‎06-29-2016

Here is what you want:

<form>
  <label>test</label>
  <fieldset submitButton="true">
    <input type="time" token="time">
      <change>
        <set token="time_label">$label$</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
         the time_label token is: $time_label$
        &lt;br/&gt;
        the time.earliest token is: $time.earliest$
        &lt;br/&gt;
        the time.latest token is: $time.latest$
      </html>
    </panel>
  </row>
</form>

rakesh_498115 · ‎06-30-2016

Thanks a lot alijohson..its working like a charm !!! 🙂

rakesh_498115 · ‎06-30-2016

alijohnson on the initial load of the form can we get the label printed ... Cause until i change the timepicker value label was not disaplaying ..is there a way to display the label on form load ??? i.e show the default value of timepicker in the label in the form load. ??

aljohnson_splun · ‎07-14-2016

Hi @Rakesh_498115 - please mark this answer as "accepted" if this solved your problem.

And yes - you can specify what you'd like the default value of the token to be. Here is an example:

<input type="dropdown" token="sourcetype_tok">
  <label>Select a source type</label>
  <default>splunkd</default>
  <choice value="splunkd">splunkd</choice>
  <choice value="splunk_web_access">splunk_web_access</choice>
  <choice value="splunkd_ui_access">splunkd_ui_access</choice>
</input>

In Splunk 4.3.2, I used the variable $search.timeRange.label$. Is there any equivalent value for this in 6.4.0?

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

.conf24 | Personalize your .conf experience with Learning Paths!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...