All Apps and Add-ons

Splunk DB Connect 1: Why am I not getting correct results when selecting a time filter on "date" using the time range picker?

kavyaa
Explorer

Hi,

I have 2011 mar to 2015 mar data. I have applied time input filter on Transdate column in my database. In the time input filter, I have selected date range between 2011-03-21 to 2011-03-23. However, I am getting all data for 2011 to 2015. I am not getting correct results regarding selected value (2011-03-21 to 2011-03-23). Please help me. Thanks in advance. The code is as below. Please check it once.


<form>
  <label>Fetch date based</label>
  <fieldset submitButton="False" autoRun="true">
    <input type="time" searchWhenChanged="true" token="tok1">
      <label></label>
      <default>
        <earliest>1300645800</earliest>
        <latest>1300905000</latest>
      </default>
    </input>
    <input type="dropdown" token="tok1" id="field2">
      <selectFirstChoice>true</selectFirstChoice>
      <populatingSearch fieldForValue="TransDate" fieldForLabel="title">
        <![CDATA[
 | gentimes start=-1 | addinfo | eval title="between '".strftime(TransDate,"%d")."' and '".strftime(TransDate,"%dT")."'"]]>
      </populatingSearch>
    </input>
    <html id="field3">
 <style>
 .input#field2
 {
 display:none;
 }
 </style>      
     </html>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Showing report to period $title$</title>
        <search>
          <query>| dbquery "CENTRO" "SELECT  ShowRoomCode as srcode , TransDate as '_time' , Num_of_Customers as totalcs FROM  Centro_Customer_Visit "</query>
          <earliest>$tok1.earliest$</earliest>
          <latest>$tok1.latest$</latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

**
alt text

0 Karma

srisahitya_v
Communicator
  1. check the retention period on data. whether it was deleted 2011 data?
  2. if you are getting "splunk deamon error: timed out" then increase "splundconnectiontimeout" and try again.
0 Karma

kavyaa
Explorer

I have checked. I have 2011 mar to 2015 mar data. What ever i selected value 2011or 2012 or 2013 , it showing all 5years data

0 Karma

srisahitya_v
Communicator

let us know, as per your retention period this particular day bucket in which form?
1. hot
2. worm
3. cold
4. frozen
5. thawed

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...