topic Re: How to give last 7 days dates to the drop-down as input in Dashboards & Visualizations

How to give last 7 days dates to the drop-down as input

prathapkcsc — Tue, 04 Jul 2017 21:25:48 GMT

HI,
I have one dashboard, i've provided drop down option for selecting til last 7 days data. In that drop down list i given present day, yesterday like. But, i want to provide last 7 days dates in that place as my drop-down list input. Is there anyway to do that?

My xml files looks like below

<form>
  <label>7 days metrics</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="TIME_STRING" searchWhenChanged="true">
      <label>Select Day</label>
      <choice value="earliest=@d latest=now">Today</choice>
      <choice value="earliest=-d@d latest=@d">Yesterday</choice>
      <choice value="earliest=-2d@d latest=-d@d">2 Days Ago</choice>
      <choice value="earliest=-3d@d latest=-2d@d">3 Days Ago</choice>
      <choice value="earliest=-4d@d latest=-3d@d">4 Days Ago</choice>
      <choice value="earliest=-5d@d latest=-4d@d">5 Day Ago</choice>
      <choice value="earliest=-6d@d latest=-5d@d">6 Days Ago</choice>
      <choice value="eariiest=-7d@d latest=-6d@d">7 Days Ago</choice>
      <default>earliest=@d latest=now</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>$TIME_STRING$ 
          source="path\*" host="my" index="main"  | rex "^\s*(?<Type>[^,]+),\s*(?<Category>[^,]+),\s*(?<date>\d{4}-\d{2}-\d{2}),\s*(?<time>\d{2}\:\d{2}),\s*(?<Count>\d+),\s*(?<Cpu_Usage_Percentage>[^,]+),\s*(?<Total_Disk_TB>[^,]+),\s*(?<Used_Disk_TB>[^,]+),\s*(?<Total_Memory_GB>[^,]+),\s*(?<Used_Memory_GB>\S+)"
| table  _time Type Category  Count Cpu_Usage_Percentage Total_Disk_TB Used_Disk_TB Total_Memory_GB Used_Memory_GB</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Any help on this?

Re: How to give last 7 days dates to the drop-down as input

MuS — Tue, 04 Jul 2017 21:38:48 GMT

Hi prathapkcsc,

This run everywhere example should work:

<form>
   <label>7 days metrics</label>
   <fieldset submitButton="false">
     <input type="dropdown" token="TIME_STRING" searchWhenChanged="true">
       <label>Select Day</label>
       <choice value="earliest=@d latest=now">Today</choice>
       <choice value="earliest=-d@d latest=@d">Yesterday</choice>
       <choice value="earliest=-2d@d latest=-d@d">2 Days Ago</choice>
       <choice value="earliest=-3d@d latest=-2d@d">3 Days Ago</choice>
       <choice value="earliest=-4d@d latest=-3d@d">4 Days Ago</choice>
       <choice value="earliest=-5d@d latest=-4d@d">5 Day Ago</choice>
       <choice value="earliest=-6d@d latest=-5d@d">6 Days Ago</choice>
       <choice value="eariiest=-7d@d latest=-6d@d">7 Days Ago</choice>
       <default>earliest=@d latest=now</default>
     </input>
   </fieldset>
   <row>
     <panel>
       <table>
         <search>
            <query>
             index="_internal" $TIME_STRING$
             | rex "^\s*(?<Type>[^,]+),\s*(?<Category>[^,]+),\s*(?<date>\d{4}-\d{2}-\d{2}),\s*(?<time>\d{2}\:\d{2}),\s*(?<Count>\d+),\s*(?<Cpu_Usage_Percentage>[^,]+),\s*(?<Total_Disk_TB>[^,]+),\s*(?<Used_Disk_TB>[^,]+),\s*(?<Total_Memory_GB>[^,]+),\s*(?<Used_Memory_GB>\S+)"
             | table  _time Type Category  Count Cpu_Usage_Percentage Total_Disk_TB Used_Disk_TB Total_Memory_GB Used_Memory_GB
             </query>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="drilldown">none</option>
       </table>
     </panel>
   </row>
 </form>

I removed the earliest and latest option from the search and also changed the XML to use < for < and the > for >.

hope this helps ...

cheers, MuS

Re: How to give last 7 days dates to the drop-down as input

prathapkcsc — Wed, 05 Jul 2017 00:09:26 GMT

You don't get my question.
I want to provide dates in drop-down list instead of today,1 day ago,2 days ago etc.
i want to give dates as drop-down list input.

Re: How to give last 7 days dates to the drop-down as input

MuS — Wed, 05 Jul 2017 00:15:31 GMT

ah I see .... let me have a look ....

Re: How to give last 7 days dates to the drop-down as input

patilsonali1729 — Thu, 13 Dec 2018 20:46:41 GMT

index=indexname earliest=-7d@d
| eval Time=strftime(_time,"%m/%d/%Y")
| bin span=1d Time
| stats count by Time
| sort -Time

Re: How to give last 7 days dates to the drop-down as input

nareshinsvu — Thu, 06 Jun 2019 07:06:32 GMT

Mate,

Use this in your search query of the dropdown. it gives last 7 days excluding today. And use "Dates" as fieldforLabel and value. It worked for me.

| gentimes start=-7 
| eval Dates=strftime(starttime,"%Y-%m-%d") 
| table Dates

Re: How to give last 7 days dates to the drop-down as input

nareshinsvu — Thu, 08 Aug 2019 03:02:06 GMT

@prathapkcsc

If it is resolved, accept and/upvote any of the replies which helped you.

Re: How to give last 7 days dates to the drop-down as input

bandit — Wed, 09 Oct 2019 03:20:27 GMT

Thanks, all, based on your examples, I've created the following dashboard template for date selection. gentimes can be adjusted to your liking, I'm using gentimes start=-365 end=1 to cover a year

<form theme="dark">
  <label>Cascading Date Selector</label>
  <fieldset submitButton="false">
    <input type="radio" token="day_type" searchWhenChanged="true">
      <label>Day Type</label>
      <choice value="*">All</choice>
      <choice value="day_of_week IN (Mon,Tue,Wed,Thu,Fri)">Business Week (Mon-Fri)</choice>
      <choice value="day_of_week IN (Sat,Sun)">Weekends (Sat-Sun)</choice>
      <default>day_of_week IN (Mon,Tue,Wed,Thu,Fri)</default>
    </input>
    <input type="radio" token="year" searchWhenChanged="true">
      <label>Year</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>year</fieldForLabel>
      <fieldForValue>year</fieldForValue>
      <search>
        <query>| gentimes start=-365 end=1 
| sort -starttime 
| eval day_of_week=strftime(starttime,"%a") 
| eval day_of_week_num=strftime(starttime,"%w") 
| eval day_of_month=strftime(starttime,"%d") 
| eval year=strftime(starttime,"%Y") 
| eval month=strftime(starttime,"%b") 
| eval month_num=strftime(starttime,"%m") 
| eval date=strftime(starttime,"%a %m-%d-%Y") 
| search $day_type$ 
| dedup year 
| table year 
| sort -year</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="month" searchWhenChanged="true">
      <label>Month</label>
      <default>*</default>
      <fieldForLabel>month</fieldForLabel>
      <fieldForValue>month</fieldForValue>
      <search>
        <query>| gentimes start=-365 end=1 
| sort starttime 
| eval day_of_week=strftime(starttime,"%a") 
| eval day_of_week_num=strftime(starttime,"%w") 
| eval day_of_month=strftime(starttime,"%d") 
| eval year=strftime(starttime,"%Y") 
| eval month=strftime(starttime,"%b") 
| eval month_num=strftime(starttime,"%m") 
| eval date=strftime(starttime,"%a %m-%d-%Y") 
| search $day_type$  year=$year$ 
| dedup month 
| sort num(month_num) 
| table month</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <choice value="*">All</choice>
    </input>
    <input type="dropdown" token="day_of_week" searchWhenChanged="true">
      <label>Day of Week</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>day_of_week</fieldForLabel>
      <fieldForValue>day_of_week</fieldForValue>
      <search>
        <query>| gentimes start=-365 end=1 
| sort -starttime 
| eval day_of_week=strftime(starttime,"%a") 
| eval day_of_week_num=strftime(starttime,"%w") 
| eval day_of_month=strftime(starttime,"%d") 
| eval year=strftime(starttime,"%Y") 
| eval month=strftime(starttime,"%b") 
| eval month_num=strftime(starttime,"%m") 
| eval date=strftime(starttime,"%a %m-%d-%Y") 
| search $day_type$ year=$year$ month=$month$ 
| dedup day_of_week 
| table day_of_week day_of_week_num 
| sort num(day_of_week_num) 
| table day_of_week</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="day_of_month" searchWhenChanged="true">
      <label>Day of Month</label>
      <choice value="*">All</choice>
      <fieldForLabel>day_of_month</fieldForLabel>
      <fieldForValue>day_of_month</fieldForValue>
      <search>
        <query>| gentimes start=-365 end=1 
| sort starttime 
| eval day_of_week=strftime(starttime,"%a") 
| eval day_of_week_num=strftime(starttime,"%w") 
| eval day_of_month=strftime(starttime,"%d") 
| eval year=strftime(starttime,"%Y") 
| eval month=strftime(starttime,"%b") 
| eval month_num=strftime(starttime,"%m") 
| eval date=strftime(starttime,"%a %m-%d-%Y") 
| search $day_type$ year=$year$ month=$month$ day_of_week=$day_of_week$
| dedup day_of_month 
| sort num(day_of_month) 
| table day_of_month</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
    </input>
    <input type="dropdown" token="date_time_range" searchWhenChanged="true">
      <label>Date</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>date</fieldForLabel>
      <fieldForValue>time_range</fieldForValue>
      <search>
        <query>| gentimes start=-365 end=1 
| sort -starttime 
| eval earliest=starttime 
| eval latest=endtime 
| eval time_range="earliest="+earliest+" latest="+latest 
| eval day_of_week=strftime(starttime,"%a") 
| eval day_of_week_num=strftime(starttime,"%w") 
| eval day_of_month=strftime(starttime,"%d") 
| eval year=strftime(starttime,"%Y") 
| eval month=strftime(starttime,"%b") 
| eval month_num=strftime(starttime,"%m") 
| eval date=strftime(starttime,"%a %m-%d-%Y") 
| search $day_type$ year=$year$ month=$month$ day_of_week=$day_of_week$ day_of_month=$day_of_month$ $date_time_range$ 
| table date time_range</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Example query with subsearch to return date ranges as query constraints:</title>
      <html>  
  <strong href="" style="color:white">your base query
[| gentimes start=-365 end=1
| sort -starttime
| eval earliest=starttime
| eval latest=endtime
| eval time_range=\"earliest=\"+earliest+\" latest=\"+latest
| eval day_of_week=strftime(starttime,\"%a\")
| eval day_of_month=strftime(starttime,\"%d\")
| eval year=strftime(starttime,\"%Y\")
| eval month=strftime(starttime,\"%b\")
| eval date=strftime(starttime,\"%a %m-%d-%Y\")
| search year="+"$"+"year"+"$"+" month="+"$"+"month"+"$"+" day_of_month="+"$"+"day_of_month"+"$"+" day_of_week="+"$"+"day_of_week"+"$"+" "+"$"+"day_type"+"$"+" "+"$"+"date_time_range"+"$"+" 
| table earliest latest
| return 1000 earliest latest]
</strong>
  </html>
    </panel>
  </row>
  <row>
    <panel>
      <title>Dates</title>
      <table>
        <search>
          <query>| gentimes start=-365 end=1 
| sort -starttime 
| eval earliest=starttime 
| eval latest=endtime 
| eval time_range="earliest="+earliest+" latest="+latest 
| eval day_of_week=strftime(starttime,"%a") 
| eval day_of_month=strftime(starttime,"%d") 
| eval year=strftime(starttime,"%Y") 
| eval month=strftime(starttime,"%b") 
| eval date=strftime(starttime,"%a %m-%d-%Y") 
| search year=$year$ month=$month$ day_of_month=$day_of_month$ day_of_week=$day_of_week$ $day_type$ $date_time_range$
| table year month day_of_month day_of_week date time_range</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">100</option>
        <option name="drilldown">none</option>
        <option name="rowNumbers">true</option>
        <option name="wrap">true</option>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="month">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="month">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="month">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="month">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="day_of_month">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="month">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="month">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="month">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="year">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="month">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="day_of_month">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="day_of_week">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
      </table>
    </panel>
    <panel>
      <title>Date  Constraints Returned</title>
      <table>
        <search>
          <query>| gentimes start=-365 end=1 
| sort -starttime 
| eval earliest=starttime 
| eval latest=endtime 
| eval time_range="earliest="+earliest+" latest="+latest 
| eval day_of_week=strftime(starttime,"%a") 
| eval day_of_month=strftime(starttime,"%d") 
| eval year=strftime(starttime,"%Y") 
| eval month=strftime(starttime,"%b") 
| eval date=strftime(starttime,"%a %m-%d-%Y") 
| search year=$year$ month=$month$ day_of_month=$day_of_month$ day_of_week=$day_of_week$ $day_type$ $date_time_range$ 
| table earliest latest 
| return 1000 earliest latest</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="rowNumbers">true</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Re: How to give last 7 days dates to the drop-down as input

bandit — Wed, 09 Oct 2019 14:44:12 GMT

Valid answer. Could be slow for large datasets. Same query with tstats

| tstats count where index=indexname earliest=-7d@d by _time
| bucket _time span=1d
| eval Time=strftime(_time,"%m/%d/%Y") 
| stats count by Time 
| sort -Time

Re: How to give last 7 days dates to the drop-down as input

bandit — Fri, 29 Oct 2021 21:39:57 GMT

Updated my previous example to use tokens as input for the date ranges.

<form theme="dark"> <label>Cascading Date Selector</label> <fieldset submitButton="false"> <input type="radio" token="day_type" searchWhenChanged="true"> <label>Day Type</label> <choice value="*">All</choice> <choice value="day_of_week IN (Mon,Tue,Wed,Thu,Fri)">Business Week (Mon-Fri)</choice> <choice value="day_of_week IN (Sat,Sun)">Weekends (Sat-Sun)</choice> <default>day_of_week IN (Mon,Tue,Wed,Thu,Fri)</default> </input> <input type="radio" token="year" searchWhenChanged="true"> <label>Year</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>year</fieldForLabel> <fieldForValue>year</fieldForValue> <search> <query>| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$ | sort -starttime | eval day_of_week=strftime(starttime,"%a") | eval day_of_week_num=strftime(starttime,"%w") | eval day_of_month=strftime(starttime,"%d") | eval year=strftime(starttime,"%Y") | eval month=strftime(starttime,"%b") | eval month_num=strftime(starttime,"%m") | eval date=strftime(starttime,"%a %m-%d-%Y") | search $day_type$ | dedup year | table year | sort -year</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="month" searchWhenChanged="true"> <label>Month</label> <default>*</default> <fieldForLabel>month</fieldForLabel> <fieldForValue>month</fieldForValue> <search> <query>| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$ | sort starttime | eval day_of_week=strftime(starttime,"%a") | eval day_of_week_num=strftime(starttime,"%w") | eval day_of_month=strftime(starttime,"%d") | eval year=strftime(starttime,"%Y") | eval month=strftime(starttime,"%b") | eval month_num=strftime(starttime,"%m") | eval date=strftime(starttime,"%a %m-%d-%Y") | search $day_type$ year=$year$ | dedup month | sort num(month_num) | table month</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <choice value="*">All</choice> </input> <input type="dropdown" token="day_of_week" searchWhenChanged="true"> <label>Day of Week</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>day_of_week</fieldForLabel> <fieldForValue>day_of_week</fieldForValue> <search> <query>| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$ | sort -starttime | eval day_of_week=strftime(starttime,"%a") | eval day_of_week_num=strftime(starttime,"%w") | eval day_of_month=strftime(starttime,"%d") | eval year=strftime(starttime,"%Y") | eval month=strftime(starttime,"%b") | eval month_num=strftime(starttime,"%m") | eval date=strftime(starttime,"%a %m-%d-%Y") | search $day_type$ year=$year$ month=$month$ | dedup day_of_week | table day_of_week day_of_week_num | sort num(day_of_week_num) | table day_of_week</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="day_of_month" searchWhenChanged="true"> <label>Day of Month</label> <choice value="*">All</choice> <fieldForLabel>day_of_month</fieldForLabel> <fieldForValue>day_of_month</fieldForValue> <search> <query>| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$ | sort starttime | eval day_of_week=strftime(starttime,"%a") | eval day_of_week_num=strftime(starttime,"%w") | eval day_of_month=strftime(starttime,"%d") | eval year=strftime(starttime,"%Y") | eval month=strftime(starttime,"%b") | eval month_num=strftime(starttime,"%m") | eval date=strftime(starttime,"%a %m-%d-%Y") | search $day_type$ year=$year$ month=$month$ day_of_week=$day_of_week$ | dedup day_of_month | sort num(day_of_month) | table day_of_month</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <default>*</default> </input> <input type="dropdown" token="date_time_range" searchWhenChanged="true"> <label>Date</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>date</fieldForLabel> <fieldForValue>time_range</fieldForValue> <search> <query>| gentimes start=-365 end=1 | sort -starttime | eval earliest=starttime | eval latest=endtime | eval time_range="earliest="+earliest+" latest="+latest | eval day_of_week=strftime(starttime,"%a") | eval day_of_week_num=strftime(starttime,"%w") | eval day_of_month=strftime(starttime,"%d") | eval year=strftime(starttime,"%Y") | eval month=strftime(starttime,"%b") | eval month_num=strftime(starttime,"%m") | eval date=strftime(starttime,"%a %m-%d-%Y") | search $day_type$ year=$year$ month=$month$ day_of_week=$day_of_week$ day_of_month=$day_of_month$ $date_time_range$ | table date time_range</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="text" token="days_to_look_back" searchWhenChanged="true"> <label>Days to look back 365=1 year</label> <default>365</default> </input> <input type="text" token="days_to_look_forward" searchWhenChanged="true"> <label>Days to look forward 1=Today</label> <default>1</default> </input> </fieldset> <row> <panel> <title>Example query with subsearch to return date ranges as query constraints:</title> <html> <strong href="" style="color:white">your base query [| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$ | sort -starttime | eval earliest=starttime | eval latest=endtime | eval time_range=\"earliest=\"+earliest+\" latest=\"+latest | eval day_of_week=strftime(starttime,\"%a\") | eval day_of_month=strftime(starttime,\"%d\") | eval year=strftime(starttime,\"%Y\") | eval month=strftime(starttime,\"%b\") | eval date=strftime(starttime,\"%a %m-%d-%Y\") | search year="+"$"+"year"+"$"+" month="+"$"+"month"+"$"+" day_of_month="+"$"+"day_of_month"+"$"+" day_of_week="+"$"+"day_of_week"+"$"+" "+"$"+"day_type"+"$"+" "+"$"+"date_time_range"+"$"+" | table earliest latest | return 1000 earliest latest] </strong> </html> </panel> </row> <row> <panel> <title>Dates</title> <table> <search> <query>| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$ | sort -starttime | eval earliest=starttime | eval latest=endtime | eval time_range="earliest="+earliest+" latest="+latest | eval day_of_week=strftime(starttime,"%a") | eval day_of_month=strftime(starttime,"%d") | eval year=strftime(starttime,"%Y") | eval month=strftime(starttime,"%b") | eval date=strftime(starttime,"%a %m-%d-%Y") | search year=$year$ month=$month$ day_of_month=$day_of_month$ day_of_week=$day_of_week$ $day_type$ $date_time_range$ | table year month day_of_month day_of_week date time_range</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">100</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">true</option> <option name="wrap">true</option> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="month"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="month"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="month"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="month"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="day_of_month"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="month"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="month"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="month"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="year"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="month"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="day_of_month"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> <format type="color" field="day_of_week"> <colorPalette type="sharedList"></colorPalette> <scale type="sharedCategory"></scale> </format> </table> </panel> <panel> <title>Date Constraints Returned</title> <table> <search> <query>| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$ | sort -starttime | eval earliest=starttime | eval latest=endtime | eval time_range="earliest="+earliest+" latest="+latest | eval day_of_week=strftime(starttime,"%a") | eval day_of_month=strftime(starttime,"%d") | eval year=strftime(starttime,"%Y") | eval month=strftime(starttime,"%b") | eval date=strftime(starttime,"%a %m-%d-%Y") | search year=$year$ month=$month$ day_of_month=$day_of_month$ day_of_week=$day_of_week$ $day_type$ $date_time_range$ | table earliest latest | return 1000 earliest latest</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">true</option> <option name="wrap">true</option> </table> </panel> </row> </form>