Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to input time using earliest and latest tokens on a string date?

$
0
0
I have a KVS that contains a week_date in the form of a string m/d/Y |inputlookup AAA__test_execution_count | eval _time=strptime(week_date,"%m/%d/%Y") Now what I want to do is have an input time on a form and use the earliest and latest tokens generated to ensure that that the week dates fall in the time range of the selected time. Business week to date to later be used in a form something like | inputlookup AAA__test_execution_count |eval _time=strptime(week_date,"%m/%d/%Y") | <<<<<< to be in the range >>>>>> specified by the input file | stats count by week_date driving range from the **query $time_token.earliest$** and **$time_token.earliest$** Now I have tried getting the **_time** as coded to then add in any tags but this does not work. I am now trying to manually generate a from and to time to compare using the settings but I am getting very confused on the different possible flavors of relative and custom times that could come out of the time picker.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>