Dashboards & Visualizations

Why am I getting error "Invalid date" trying to set now as default value for the date time picker?

s_aria
New Member

Hi all,

I'm trying to set now value for a default setting:

    <input type="time" token="time" searchWhenChanged="true">
      <label></label>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>now</latestTime>
      </default>
      <change>
        <eval token="form.et">strftime('earliest', "%F")</eval>
        <eval token="form.lt">strftime('latest', "%F")</eval>
      </change>
    </input>

I keep getting an error when I try and run the query with default value for latest. Only in this case.

Any advice would be well received.

Thanks,
Sal

0 Karma

erwanlebaron
Engager

The issue came from the fact the format is done as "relative date".
Try to change

<eval token="form.et">strftime('earliest', "%F")</eval>

by

<eval token="form.et">strftime(relative_time(now(),'earliest'), "%F"</eval>
0 Karma

sundareshr
Legend

Should be earliest & latest

 <input type="time" token="time" searchWhenChanged="true">
       <label></label>
       <default>
         <earliest>0</earliestTime>
         <latest>now</latestTime>
       </default>
       <change>
         <eval token="form.et">strftime('earliest', "%F")</eval>
         <eval token="form.lt">strftime('latest', "%F")</eval>
       </change>
     </input>
0 Karma

s_aria
New Member

also replacing the tag name the error persist.

Thanks,
Sal

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @s.aria,
Could you try substituting "earliest" and "latest" for these two tags? For one, "earliestTime" and "latestTime" are deprecated and 'earliest'/'latest' should be used instead. I also wonder if the difference in the tag name you are using (earliestTime) and the reference you are passing to the strftime function ('earliest'), might be causing an issue.

Hope this helps! Let me know if this does not fix the problem and we can keep discussing.

0 Karma

s_aria
New Member

Hi @frobinson

Thanks for the reply.
I tried replacing the tag name, but the error persist:
form.et=1970-01-01
form.lt=Invalid date

Thanks,
Sal

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi Sal,
What search string are you using? Can you post it?

0 Karma

s_aria
New Member

Hi,

in a | dbquery ....... WHERE FIELD >= STR_TO_DATE('$form.lt$','%Y-%m-%d')

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...