https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197708#M57148 <P>Thanks martin.</P> Wed, 29 Jun 2016 22:32:17 GMT Kukkadapu 2016-06-29T22:32:17Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197695#M57135 <P>I'm migrating from index = .. notation to a datamodel definition. </P> <P>I'm stuck with the use of the "earliest" and "latest" parameters in a search. Í have a drop list with time options and my search looks like:</P> <P>index="index1" earliest=@$TimePeriod1$ latest=+1$TimePeriod1$@$TimePeriod1$| timechart count(...</P> <P>where TimePeriod1 is a result of a drop down (d,w,mon,q)</P> <P>Now with datamodels, I don't know where to select the time values.</P> <P>| datamodel TEST SUCCESS search | search earliest=@$TimePeriod1$ latest=+1$TimePeriod1$@$TimePeriod1$| timechart count(...<BR /> doesn't work.</P> <P>Any suggestion?</P> <P>Thanks!</P> Sat, 08 Nov 2014 00:16:48 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197695#M57135 snemiro_514 2014-11-08T00:16:48Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197696#M57136 <P>Why are you stuck with setting the time range in the search rather than using the regular time range?</P> Sat, 08 Nov 2014 00:33:16 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197696#M57136 martin_mueller 2014-11-08T00:33:16Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197697#M57137 <P>The dashboard allows users to choose the time to compare between different periods of data. They can choose days, weeks, months, quarters, years, so I show a graphic of "this period" and "previous period".</P> Sat, 08 Nov 2014 00:48:21 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197697#M57137 snemiro_514 2014-11-08T00:48:21Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197698#M57138 <P>Why not set the time range in the earliest and latest time tags?</P> Sat, 08 Nov 2014 00:57:10 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197698#M57138 martin_mueller 2014-11-08T00:57:10Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197699#M57139 <P>That might work. We are ending the day here. I will try it on Monday. Thank you, Martin!</P> Sat, 08 Nov 2014 01:02:25 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197699#M57139 snemiro_514 2014-11-08T01:02:25Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197700#M57140 <P>Works like a charm. Thanks!</P> Mon, 10 Nov 2014 17:00:15 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197700#M57140 snemiro_514 2014-11-10T17:00:15Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197701#M57141 <P>Using the tags instead of the search parameters solved the problem. Thanks Martin!</P> <P>"martin_mueller ♦ · </P> <P>Why not set the time range in the earliest and latest time tags?<BR /> "</P> Mon, 10 Nov 2014 18:36:32 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197701#M57141 snemiro_514 2014-11-10T18:36:32Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197702#M57142 <P>Hi Snemiro, Can you elaborate the fix? I mean how to use tags in search parameters with datamodel. </P> <P>Thanks.</P> Mon, 27 Jun 2016 22:00:10 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197702#M57142 Kukkadapu 2016-06-27T22:00:10Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197703#M57143 <P>Hi Martin,<BR /> Can you tell me how to set the time range in the earliest and latest time tags?</P> <P>Thanks.</P> Mon, 27 Jun 2016 23:53:14 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197703#M57143 Kukkadapu 2016-06-27T23:53:14Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197704#M57144 <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/PanelreferenceforSimplifiedXML#search_element">http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/PanelreferenceforSimplifiedXML#search_element</A></P> Tue, 28 Jun 2016 00:53:49 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197704#M57144 martin_mueller 2016-06-28T00:53:49Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197705#M57145 <P>Thanks Martin. I'll check the document and try it. Appreciate your time</P> Tue, 28 Jun 2016 16:25:33 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197705#M57145 Kukkadapu 2016-06-28T16:25:33Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197706#M57146 <P>Hi Matin, I've set the time range in the earliest and latest time tags and it worked fine.</P> <P>But my use case is to join two datamodels and each datamodel has different time stamps. I can pass one time range for a datamodel but not sure how to do it for multiple datamodels? Any ideas?</P> <P>Thanks.</P> Wed, 29 Jun 2016 22:03:08 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197706#M57146 Kukkadapu 2016-06-29T22:03:08Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197707#M57147 <P>I see - tstats can search accelerated datamodels, and supports inline filtering by earliest and latest: <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Tstats#Filtering_with_where">http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Tstats#Filtering_with_where</A></P> Wed, 29 Jun 2016 22:25:52 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197707#M57147 martin_mueller 2016-06-29T22:25:52Z https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197708#M57148 <P>Thanks martin.</P> Wed, 29 Jun 2016 22:32:17 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-time-selectors-and-datamodel/m-p/197708#M57148 Kukkadapu 2016-06-29T22:32:17Z