Splunk Search

Time token returning NAN error

av_
Path Finder

I have a time picker & a time dropdown which has static values.  

<panel id="pqr">
<input type="time" token="time">
<label>DateTime</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
</panel>

<panel id="abc">
<input type="dropdown" token="timedrop">
<label>Time Dropdown</label>
<choice value="now">Now</choice>
<choice value="+3d">3d</choice>
<choice value="+4d">4d</choice>
<choice value="+5d">5d</choice>
<default>now</default>
<change>
<eval token="latest_Time">if('timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>
</change>
</input>
</panel>

The expectation is if Now is selected in timedrop, the data till now should load. If +3d is selected in timedrop, then +3d should be added with the time.latest token (coming from the time picker) and so on.
On load (by default Today is selected), the latest_Time is returning NAN, but if I select a specific time range (say 8th April 10AM-11AM) & timedrop as 3d, it is working as expected.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try like this:

    <panel id="pqr">
      <input type="time" token="time">
        <label>DateTime</label>
        <default>
          <earliest>@d</earliest>
          <latest>now</latest>
        </default>
      </input>
    </panel>
    <panel id="abc">
      <title>Latest time token $latest_Time$</title>
      <input type="dropdown" token="timedrop">
        <label>Time Dropdown</label>
        <choice value="now">Now</choice>
        <choice value="+3d">3d</choice>
        <choice value="+4d">4d</choice>
        <choice value="+5d">5d</choice>
        <default>now</default>
        <change>
          <eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>
        </change>
      </input>
    </panel>

There doesn't seem to be a way to set an initial value on a time input - perhaps this is a bug?

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try like this:

    <panel id="pqr">
      <input type="time" token="time">
        <label>DateTime</label>
        <default>
          <earliest>@d</earliest>
          <latest>now</latest>
        </default>
      </input>
    </panel>
    <panel id="abc">
      <title>Latest time token $latest_Time$</title>
      <input type="dropdown" token="timedrop">
        <label>Time Dropdown</label>
        <choice value="now">Now</choice>
        <choice value="+3d">3d</choice>
        <choice value="+4d">4d</choice>
        <choice value="+5d">5d</choice>
        <default>now</default>
        <change>
          <eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>
        </change>
      </input>
    </panel>

There doesn't seem to be a way to set an initial value on a time input - perhaps this is a bug?

av_
Path Finder

Tried this method but for some reason I still see the same error. 

av__0-1714043422536.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

All you have shown is a screen grab of something that isn't working without any detail of what you have actually tried i.e. the SimpleXML you are using in this instance. Please share some useful information.

0 Karma

av_
Path Finder

I've already given all the details & mentioned earlier that I used your method.  To be specific, I used this below mentioned statement in the "timedrop" dropdown change section.
But still getting Nan error

<panel id="pqr">
<input type="time" token="time">
<label>DateTime</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
</panel>

<panel id="abc">
<input type="dropdown" token="timedrop">
<label>Time Dropdown</label>
<choice value="now">Now</choice>
<choice value="+3d">3d</choice>
<choice value="+4d">4d</choice>
<choice value="+5d">5d</choice>
<default>now</default>
<change>
<eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval></change>
</input>
</panel>
0 Karma

av_
Path Finder

@ITWhisperer I've removed the option Now from the dropdown, what should be the new eval statement instead of

<eval token="latest_Time">if(isnull('timedrop') or 'timedrop'="now",now(),relative_time(if($time.latest$="now",now(),$time.latest$), $timedrop$))</eval>

?

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Except that the screen grab you showed is not from this SimpleXML code

ITWhisperer_0-1714046382573.png

 

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...