topic Re: using different date range but showing the same value in Splunk Search

using different date range but showing the same value

ramkyreddy — Thu, 08 Feb 2024 16:29:29 GMT

When I was searching for the different data ranges in my Splunk dashboard it showed the same,
for example, i am selecting 1/1/2024 to 1/10/2024 and 1/3/2024 to 1/4/2024 and
i am adding this query earliest=-7d@d latest=+1d but when removed these values do not match

Please help out with this

Re: using different date range but showing the same value

ITWhisperer — Wed, 24 Jan 2024 13:00:44 GMT

Looks like your search may be wrong - please share the source of your dashboard in a code block

Re: using different date range but showing the same value

ramkyreddy — Mon, 29 Jan 2024 02:01:03 GMT

selected the date from 1 jan 2024 to 2 jan 2024
----------------------------------------------------------------
index="bsds_gans" earliest=1704096000 latest=+1d pfor IN (*) test IN (*) name IN (*) ckb IN (*) vrsion IN (*) id IN (*) location IN (*) group IN (*)

| eval pfor=upper(pfor)
| eval _time = start_time
| eval WW=strftime(_time, "%V.%w")
| eval name=mvindex(split(context,"."),1)
| search name !="*Case Setup*"
| eval name=mvindex(split(name,".PSPV"),0)
| eval id=mvindex(split(name," - "),0)
| search id IN (*)
| eval main=mvindex(split(name," - "),1)
| search main IN (*)
| stats count(eval(sta="FIL")) as fail_count, count(eval(sta="PASS")) as pass_count, count(eval(like(sta,"LOCKED%"))) as not_run_count by name,id

--------------------------------------------------------------------
selected date is from 1jan 2024 to 13 jan 2024

index="bsds_gans" earliest=1704096000 latest=+1d pfor IN (*) test IN (*) name IN (*) ckb IN (*) vrsion IN (*) id IN (*) location IN (*) group IN (*)

| eval pfor=upper(pfor)
| eval _time = start_time
| eval WW=strftime(_time, "%V.%w")
| eval name=mvindex(split(context,"."),1)
| search name !="*Case Setup*"
| eval name=mvindex(split(name,".PSPV"),0)
| eval id=mvindex(split(name," - "),0)
| search id IN (*)
| eval main=mvindex(split(name," - "),1)
| search main IN (*)
| stats count(eval(sta="FIL")) as fail_count, count(eval(sta="PASS")) as pass_count, count(eval(like(sta,"LOCKED%"))) as not_run_count by name,id
-----------------------------------------------------------------------
selected for last 7 days

index="bsds_gans" earliest=-7d@h latest=+1d pfor IN (*) test IN (*) name IN (*) ckb IN (*) version IN (*) id IN (*) location IN (*) group IN (*)

Re: using different date range but showing the same value

ITWhisperer — Mon, 29 Jan 2024 09:27:22 GMT

The earliest and latest settings in the search are overriding the values chosen from the timepicker and since these are the same, the numbers in your panels are the same.

Re: using different date range but showing the same value

ramkyreddy — Mon, 29 Jan 2024 10:22:51 GMT

The numbers in the panels are the same when trying different time ranges as I mentioned in the above search query

Re: using different date range but showing the same value

ITWhisperer — Mon, 29 Jan 2024 10:40:49 GMT

It is not clear what searches are giving what results - you mentioned 3 searches, but showed only two sets of panels. All the searches you have shown use earliest and latest settings which override anything you have chosen in the timepicker, so it is not clear which timeperiods have been used for which sets of panels. Please clarify