In my Splunk Dashboard I have a time picker and charts which shows a search for each subsequent day from the earliest time selected in the time picker.
I want to display a formatted date in a label for each chart. So for example:
Day 1 - 15/12/2015
Day 2 - 16/12/2015
Day 3 - 17/12/2015
etc
I understand that these dates can be derived from the time picker's token. Here is what I have attempted so far just for the first date but it does not seem to work:
-15m now strptime($InputTime.earliest$, "%m/%d/%Y") Day 1 - $new_time$
Could anybody tell me what I am doing wrong?
Thanks
↧