topic Re: Adding a Time Range (Extending to the Future) and Use it in a Timechart in Splunk Search https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474704#M133493 <P>Good question, sorry I failed to clarify that, I will use another field called (objTimestamp) or even the _time field, since they are very close to each other. Thanks.</P> Fri, 21 Feb 2020 08:09:37 GMT jameldebbiche 2020-02-21T08:09:37Z Adding a Time Range (Extending to the Future) and Use it in a Timechart https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474702#M133491 <P>Hi everyone, </P> <P>We have logs that contain field named "var" with num data type, the value of this field changes through time, so we have two more fields in the log, startDate (when the var acquired the value written in that log) and endDate (when the var value will expire). Both dates are written in the %Y%m%d format. And of course, some of the endDate values are in the future. </P> <P>I want to create a timechart where the x-axis starts from the first startDate value of the var field and ends at the latest endDate which is in the future. So my question is, after many days of research, is it possible to create a time range that is to be used in the timechart? Something like: </P> <P>|eval customTimeRange = [earliest(startDate) .. latest(endDate)]<BR /> |chart values(var) over customTimeRange by source</P> <P>Or something similar? Maybe it is worth mentioning, that I want it as a line chart, where the line is continuous and the last value will extend on the chart till the endDate value.</P> <P>Any help would be appreciated! Thanks in advance.</P> Thu, 20 Feb 2020 10:47:07 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474702#M133491 jameldebbiche 2020-02-20T10:47:07Z Re: Adding a Time Range (Extending to the Future) and Use it in a Timechart https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474703#M133492 <P>So every event has the startDate and EndDate and the var(value)? If that is correct and the x axis is the time line of start to end date, what time would you use in the event to place the var(value) on the timeline?</P> Fri, 21 Feb 2020 05:07:59 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474703#M133492 mydog8it 2020-02-21T05:07:59Z Re: Adding a Time Range (Extending to the Future) and Use it in a Timechart https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474704#M133493 <P>Good question, sorry I failed to clarify that, I will use another field called (objTimestamp) or even the _time field, since they are very close to each other. Thanks.</P> Fri, 21 Feb 2020 08:09:37 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474704#M133493 jameldebbiche 2020-02-21T08:09:37Z Re: Adding a Time Range (Extending to the Future) and Use it in a Timechart https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474705#M133494 <P><CODE>Use it in a Timechart</CODE><BR /> what's y-axis?</P> Fri, 21 Feb 2020 08:15:54 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474705#M133494 to4kawa 2020-02-21T08:15:54Z Re: Adding a Time Range (Extending to the Future) and Use it in a Timechart https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474706#M133495 <P>Y axis will be the var value. But timechart will only use _time on the x axis and not the custom range of the earliest startDate and the latest endDate, so that is not I am not using timechart.</P> Fri, 21 Feb 2020 08:24:59 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474706#M133495 jameldebbiche 2020-02-21T08:24:59Z Re: Adding a Time Range (Extending to the Future) and Use it in a Timechart https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474707#M133496 <P>If <CODE>earliest startDate and the latest endDate</CODE>is epoch, timechart can be.</P> Fri, 21 Feb 2020 08:27:36 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474707#M133496 to4kawa 2020-02-21T08:27:36Z Re: Adding a Time Range (Extending to the Future) and Use it in a Timechart https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474708#M133497 <PRE><CODE>your search | eval time=mvappend(startDate,endDate) | streamstats count as session | mvexpand time | eval time=strptime(time, "%Y%m%d") | table time var | rename time as _time </CODE></PRE> Fri, 21 Feb 2020 08:36:32 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-Time-Range-Extending-to-the-Future-and-Use-it-in-a/m-p/474708#M133497 to4kawa 2020-02-21T08:36:32Z