topic Re: search by range & dashboard help in Splunk Search

search by range & dashboard help

changwoo — Wed, 15 Jan 2014 00:30:08 GMT

i am trying to search by year

i have a field like movie_year ( ex: 1991, 1999, 2000)

and i want make a dashboard which is seperated by 10years

what can i do ?

Re: search by range & dashboard help

HiroshiSatoh — Mon, 28 Sep 2020 15:39:18 GMT

For example, a search sentence can be made in this way.
････|eval years=substr(movie_year,1,3) + "0'S"

movie_year,years,･･･
1980,1980'S,･･･
1981,1980'S,･･･
1992,1990'S,･･･
1999,1990'S,･･･

I do not know that there is no image dashboard.

Re: search by range & dashboard help

somesoni2 — Wed, 15 Jan 2014 01:17:22 GMT

Are looking to group movies by decade? If yes than try this

your search | eval decade=floor(movie_year/10)*10

This will give values like this
movie_year decade
1991 1990
1999 1990
2000 2000
2003 2000

field value which is 10 year apart.

Re: search by range & dashboard help

changwoo — Thu, 16 Jan 2014 00:18:32 GMT

thanks for your help