I have input data in below format:
Currently, I am able to mark only the Startdate as vacation in my calendar visualization using below query:
*| eval _time=strptime(Startdate,"%d-%b-%Y")
| timechart span=1d count by Emp_Name*
Please help on how to mark all the days from Startdate to Enddate in my calendar.
Ah, In that case.. try this:
| gentimes start=03/01/2019 end=03/25/2019 | eval _time=starttime | eval Emp_Name="rpradeep", Start_date="2-mar-2019", End_date="8-mar-2019" | eval start=strptime(Start_date,"%d-%b-%Y"), end=strptime(End_date,"%d-%b-%Y") | eval vacation=if((_time>=start AND _time<=end),"yes","no") | where vacation="yes" | timechart count by Emp_Name
The first 3 lines, just generate some fake data, the last 4 lines should drop into your search
consider our outlook meeting calendar look.
There will be meeting start time and end time
In Month view I'll be able to show start time and end time which is managebale, But when you switch to week/day view.. the start time and end time capture will be not accurate. since _time will have only start time. When the meeting will end time will not be proper.
I assume you are using the timeline visualization?
This search works in my testing:
| makeresults 1 | eval Emp_Name="rpradeep", Start_date="1-jan-2019", End_date="8-Jan-2019" | eval _time=strptime(Start_date,"%d-%b-%Y"), end=strptime(End_date,"%d-%b-%Y") | eval duration=round(((end-_time)*1000),0) | table _time Emp_Name duration
Even i'm looking for answer for same question..
The current version of app doesn't support for start and end datetime, only can mark on spot. The app is having really good viz in splunk for calendar look.
If they update for start and end date color mapping then jakkaas awesome..