All Apps and Add-ons

Splunk DB Connect 1: Why am I not getting correct results when selecting a time filter on "date" using the time range picker?

kavyaa
Explorer

Hi,

I have 2011 mar to 2015 mar data. I have applied time input filter on Transdate column in my database. In the time input filter, I have selected date range between 2011-03-21 to 2011-03-23. However, I am getting all data for 2011 to 2015. I am not getting correct results regarding selected value (2011-03-21 to 2011-03-23). Please help me. Thanks in advance. The code is as below. Please check it once.


<form>
  <label>Fetch date based</label>
  <fieldset submitButton="False" autoRun="true">
    <input type="time" searchWhenChanged="true" token="tok1">
      <label></label>
      <default>
        <earliest>1300645800</earliest>
        <latest>1300905000</latest>
      </default>
    </input>
    <input type="dropdown" token="tok1" id="field2">
      <selectFirstChoice>true</selectFirstChoice>
      <populatingSearch fieldForValue="TransDate" fieldForLabel="title">
        <![CDATA[
 | gentimes start=-1 | addinfo | eval title="between '".strftime(TransDate,"%d")."' and '".strftime(TransDate,"%dT")."'"]]>
      </populatingSearch>
    </input>
    <html id="field3">
 <style>
 .input#field2
 {
 display:none;
 }
 </style>      
     </html>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Showing report to period $title$</title>
        <search>
          <query>| dbquery "CENTRO" "SELECT  ShowRoomCode as srcode , TransDate as '_time' , Num_of_Customers as totalcs FROM  Centro_Customer_Visit "</query>
          <earliest>$tok1.earliest$</earliest>
          <latest>$tok1.latest$</latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

**
alt text

0 Karma

srisahitya_v
Communicator
  1. check the retention period on data. whether it was deleted 2011 data?
  2. if you are getting "splunk deamon error: timed out" then increase "splundconnectiontimeout" and try again.
0 Karma

kavyaa
Explorer

I have checked. I have 2011 mar to 2015 mar data. What ever i selected value 2011or 2012 or 2013 , it showing all 5years data

0 Karma

srisahitya_v
Communicator

let us know, as per your retention period this particular day bucket in which form?
1. hot
2. worm
3. cold
4. frozen
5. thawed

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...