topic Re: Filtering the results in Dashboard from InputLookup Depend Upon Time in Splunk Search

Filtering the results in Dashboard from InputLookup Depend Upon Time

cchange — Wed, 30 Sep 2020 04:55:29 GMT

Hi,

I'm trying to filter the results of the lookup depend upon the time selection from the dashboard. I have date field in the lookup. Below is the sample of the lookup.

ReportedAt Id status
2020-04-09 5:00:00 567 Pass

I'm trying with below logics but it is not working.

|inputlookup file.csv
|eval timeep = strptime('ReportedAt', "%Y-%m-%d %H:%S")
| addinfo
| where timeep > info_max_time and timeep < info_min_time

====
inputlookup file.csv | where Reportedat > $t1.earliest$ and Reportedat < $t1.latest$

Can you please let me know is there a way to display the results depend upon time selection in the dashboard.

Re: Filtering the results in Dashboard from InputLookup Depend Upon Time

richgalloway — Wed, 08 Apr 2020 19:27:33 GMT

The first method should work, except the strptime format string is incorrect. Try |eval timeep = strptime('ReportedAt', "%Y-%m-%d %H:%M:%S").
The second method won't work because Splunk can't compare dates in string format.

Re: Filtering the results in Dashboard from InputLookup Depend Upon Time

cchange — Thu, 09 Apr 2020 03:31:26 GMT

Thanks Rich, I overlooked the syntax. Problem is with my where clause. I used logic wrongly and it is not matching filter condition. After correcting my logic, results started to display correctly for first method.

Thanks for your help once again.