topic Duration Filter without _time in Getting Data In

Duration Filter without _time

andrehl — Wed, 01 Aug 2018 02:04:46 GMT

Hi Community!
I wanted to create a dashboard that have TWO filters assigned to a graph.

Date:                                              Duration:
2018-08-01                                         6months


My graph x-axis:



2018-03     2018-04    2018-05    2018-06    2018-07    2018-08

Be informed that I do not utilize the built-in Splunk _time system and thus I cannot use the _time input provided in the filter.

I tried using this as my filter code: - strptime("0000-06-00","%Y-%m-%d") but it didnt work.

Thanks guys!

Re: Duration Filter without _time

niketn — Wed, 01 Aug 2018 06:12:28 GMT

@andrehl you requirement for two inputs is not clear based on details provided. If Date input is not Splunk's Time Picker input, is it html time input?

If so please refer to one of my older answer to use html time input with jQuery (Simple XML JS Extension) to capture selected time and use in Splunk Dashboard as custom token: https://answers.splunk.com/answers/627432/jquery-datepicker-in-splunk.html

You would need to explain more about what is Duration filter? What are its possible values and how is Duration applied to searches along with Date? Is it a Combination of both Date and Duration or only one can be applied at a time?

Please elaborate with meaningful description and data.

Re: Duration Filter without _time

DalJeanis — Thu, 02 Aug 2018 05:22:38 GMT

You probably want to use the relative_time() function to calculate your boundaries.

| eval new_time = relative_time(now(),"-6mon@mon")

Re: Duration Filter without _time

andrehl — Wed, 08 Aug 2018 01:41:18 GMT

Hi @niketnilay, thank you for the feedback! Please pardon my unfamiliarity with programming languages.
My data came from excel files, similar to this:
Date_created
2017-05-13
2017-05-14
2017-07-14
2018-01-05

What I want to do is for the user to select filters (combination of both), Year: 2017 Month: 06, and Duration: Past 6 Months and my dashboard is supposed to only show datas from 2017 January to 2017 June.

Re: Duration Filter without _time

andrehl — Wed, 08 Aug 2018 01:41:58 GMT

sorry, it didn't work for me