<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Create dropdown of two-week range (gentimes) in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311413#M19898</link>
    <description>&lt;P&gt;I'd like to create a dropdown that has two week spans. It should be formatted as follows:&lt;/P&gt;

&lt;P&gt;01/01/2017 - 01/14/2017&lt;BR /&gt;
01/15/2017 - 01/29/2017&lt;BR /&gt;
...&lt;/P&gt;

&lt;P&gt;I'd like to use this dropdown to group the data. I believe this could be accomplished with gentimes. I just don't know how to format the search.&lt;/P&gt;</description>
    <pubDate>Thu, 18 Jan 2018 18:08:38 GMT</pubDate>
    <dc:creator>sogeniusio</dc:creator>
    <dc:date>2018-01-18T18:08:38Z</dc:date>
    <item>
      <title>Create dropdown of two-week range (gentimes)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311413#M19898</link>
      <description>&lt;P&gt;I'd like to create a dropdown that has two week spans. It should be formatted as follows:&lt;/P&gt;

&lt;P&gt;01/01/2017 - 01/14/2017&lt;BR /&gt;
01/15/2017 - 01/29/2017&lt;BR /&gt;
...&lt;/P&gt;

&lt;P&gt;I'd like to use this dropdown to group the data. I believe this could be accomplished with gentimes. I just don't know how to format the search.&lt;/P&gt;</description>
      <pubDate>Thu, 18 Jan 2018 18:08:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311413#M19898</guid>
      <dc:creator>sogeniusio</dc:creator>
      <dc:date>2018-01-18T18:08:38Z</dc:date>
    </item>
    <item>
      <title>Re: Create dropdown of two-week range (gentimes)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311414#M19899</link>
      <description>&lt;P&gt;Do you calculate those two spans based on current date?&lt;/P&gt;</description>
      <pubDate>Thu, 18 Jan 2018 19:35:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311414#M19899</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2018-01-18T19:35:13Z</dc:date>
    </item>
    <item>
      <title>Re: Create dropdown of two-week range (gentimes)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311415#M19900</link>
      <description>&lt;P&gt;hey you can try something like this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| gentimes start=01/01/2017  increment=14d | eval starthuman=strftime(starttime,"%m/%d/%Y") |eval endhuman=strftime(endtime,"%m/%d/%Y") | eval date=starthuman." - ".endhuman | fields date
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;let me know if this helps !&lt;/P&gt;</description>
      <pubDate>Thu, 18 Jan 2018 20:02:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311415#M19900</guid>
      <dc:creator>mayurr98</dc:creator>
      <dc:date>2018-01-18T20:02:43Z</dc:date>
    </item>
    <item>
      <title>Re: Create dropdown of two-week range (gentimes)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311416#M19901</link>
      <description>&lt;P&gt;Seems to work in a regular search but when I place it within the search for the dropdown it says it has conflicts due to duplicates.&lt;/P&gt;</description>
      <pubDate>Thu, 18 Jan 2018 21:21:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311416#M19901</guid>
      <dc:creator>sogeniusio</dc:creator>
      <dc:date>2018-01-18T21:21:16Z</dc:date>
    </item>
    <item>
      <title>Re: Create dropdown of two-week range (gentimes)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311417#M19902</link>
      <description>&lt;P&gt;Your solution required some edits&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| gentimes start=-240 increment=14d 
| eval starthuman=strftime(starttime,"%m/%d/%Y") 
| eval endhuman=strftime(endtime,"%m/%d/%Y")
| bin span=14d endtime
| eval date=starthuman." - ".endhuman 
| table date
| reverse
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;How would I go about using these values in my search?&lt;/P&gt;</description>
      <pubDate>Thu, 18 Jan 2018 21:43:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311417#M19902</guid>
      <dc:creator>sogeniusio</dc:creator>
      <dc:date>2018-01-18T21:43:08Z</dc:date>
    </item>
    <item>
      <title>Re: Create dropdown of two-week range (gentimes)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311418#M19903</link>
      <description>&lt;P&gt;Yes I'd like it to be calculated based on the current date. Since today is 1/18 the range should be 1/3 - 1/18&lt;/P&gt;</description>
      <pubDate>Thu, 18 Jan 2018 21:51:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311418#M19903</guid>
      <dc:creator>sogeniusio</dc:creator>
      <dc:date>2018-01-18T21:51:29Z</dc:date>
    </item>
    <item>
      <title>Re: Create dropdown of two-week range (gentimes)</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311419#M19904</link>
      <description>&lt;P&gt;yes, it looks fine just use &lt;CODE&gt;sort&lt;/CODE&gt; instead of &lt;CODE&gt;reverse&lt;/CODE&gt;.&lt;BR /&gt;
Also to solve &lt;CODE&gt;conflicts due to duplicates&lt;/CODE&gt; try this&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    &amp;lt;input type="dropdown" token="field2" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;date&amp;lt;/label&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;field2&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;field2&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;search&amp;gt;
        &amp;lt;query&amp;gt;| gentimes start=-240 increment=14d 
 | eval starthuman=strftime(starttime,"%m/%d/%Y") 
 | eval endhuman=strftime(endtime,"%m/%d/%Y")
 | bin span=14d endtime
 | eval field2=starthuman." - ".endhuman 
 | table field2
 | sort field2&amp;lt;/query&amp;gt;
        &amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;
        &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
      &amp;lt;/search&amp;gt;
    &amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;field-label/value/token/and query field-name needs to be same.&lt;/P&gt;</description>
      <pubDate>Fri, 19 Jan 2018 06:20:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Create-dropdown-of-two-week-range-gentimes/m-p/311419#M19904</guid>
      <dc:creator>mayurr98</dc:creator>
      <dc:date>2018-01-19T06:20:21Z</dc:date>
    </item>
  </channel>
</rss>

