Archive

Splunk DB Connect 1: Why am I not getting correct results when selecting a time filter on "date" using the time range picker?

Explorer

Hi,

I have 2011 mar to 2015 mar data. I have applied time input filter on Transdate column in my database. In the time input filter, I have selected date range between 2011-03-21 to 2011-03-23. However, I am getting all data for 2011 to 2015. I am not getting correct results regarding selected value (2011-03-21 to 2011-03-23). Please help me. Thanks in advance. The code is as below. Please check it once.


<form>
  <label>Fetch date based</label>
  <fieldset submitButton="False" autoRun="true">
    <input type="time" searchWhenChanged="true" token="tok1">
      <label></label>
      <default>
        <earliest>1300645800</earliest>
        <latest>1300905000</latest>
      </default>
    </input>
    <input type="dropdown" token="tok1" id="field2">
      <selectFirstChoice>true</selectFirstChoice>
      <populatingSearch fieldForValue="TransDate" fieldForLabel="title">
        <![CDATA[
 | gentimes start=-1 | addinfo | eval title="between '".strftime(TransDate,"%d")."' and '".strftime(TransDate,"%dT")."'"]]>
      </populatingSearch>
    </input>
    <html id="field3">
 <style>
 .input#field2
 {
 display:none;
 }
 </style>      
     </html>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Showing report to period $title$</title>
        <search>
          <query>| dbquery "CENTRO" "SELECT  ShowRoomCode as srcode , TransDate as '_time' , Num_of_Customers as totalcs FROM  Centro_Customer_Visit "</query>
          <earliest>$tok1.earliest$</earliest>
          <latest>$tok1.latest$</latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

**
alt text

0 Karma

Communicator
  1. check the retention period on data. whether it was deleted 2011 data?
  2. if you are getting "splunk deamon error: timed out" then increase "splundconnectiontimeout" and try again.
0 Karma

Explorer

I have checked. I have 2011 mar to 2015 mar data. What ever i selected value 2011or 2012 or 2013 , it showing all 5years data

0 Karma

Communicator

let us know, as per your retention period this particular day bucket in which form?
1. hot
2. worm
3. cold
4. frozen
5. thawed

0 Karma