topic How to create a dashboard on a custom field and add a timing filter on the custom field? in Dashboards & Visualizations

How to create a dashboard on a custom field and add a timing filter on the custom field?

aniello_cerrato — Thu, 27 Oct 2016 14:20:31 GMT

Hi,

I have a problem with a dashboard. I have to create a timechart dashboard on a custom field (that is not index time) and also add a timing filter on this custom field.

I have created the dashboard in the following way:

| eval _time=strftime(myfield,....) | timechart ...

But when I add input time and it filters on original _time and not new time.

Please let me know.

Thanks,
Aniello

Re: How to create a dashboard on a custom field and add a timing filter on the custom field?

somesoni2 — Thu, 27 Oct 2016 15:46:24 GMT

That's the limitation when you're not timecharting with original/splunk-extracted _time. The time range picker is applied on base search (before first pipe) and thus only works on _time available at that time. Since you're calculating your _time later (based on custom field), it won't honor the timerange picker.

Your option would be to explicitly set the time range picket to "All Time" OR something suitable length which will include all the data for your selected time range, and add time range filter using subsearch after you calculate your new _time. Something like this

index=foo sourcetype=bar .. earliest=0 latest=now | eval _time=strptime(customfield,"...timeformat..") | where _time>=[| gentimes start=-1 | addinfo | eval search=info_min_time | table search] AND _time<[| gentimes start=-1 | addinfo | eval search=info_max_time | table search] | ..rest of the search

Re: How to create a dashboard on a custom field and add a timing filter on the custom field?

aniello_cerrato — Thu, 27 Oct 2016 15:54:42 GMT

Hi,

in your search how can I add the filter time?Always using add input?