Dashboards & Visualizations

Add a filter on time field in a dashboard (to search a specific day)

kvnpichon
Path Finder

Hello Splunkers,

I have created a dashboard about the number of events indexed per day (history).

This what it looks like :

history_indexing_dashboard.png

 

 

 

 

 

My question is, how can I create a select/search field to be able to specify a date (format : YYYY-MM-DD) and display the number of events for this specific date  ?

For example I specify the "2020-07-26" date in the search field  and the dashboard must displays the only line with the date and the number of events at this date (Number of Events = 107119 in the example).

Hope you can help me,

Regards

Labels (3)
1 Solution

kvnpichon
Path Finder

Hello,

I found a solution to my issue :

I used a time range picker and used the $time$ token.

In the source code of my dashboard (xml) I added 2 lines just after the query  :

<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>

So, now its looks like :

kvnpichon_0-1595922643868.png

Thanks for reply.

View solution in original post

spitchika
Path Finder

1# Best way is, populate all your _time into Dropdown input and select from there. You can just include dropdown and in search string you can give a query to populate dates (I think you already have that query based on your screenshot)

2# in case your dates are too many then its difficult to select from drop down, in that case you can go with "Textbox" input type, It will act as variable in programming language :).

0 Karma

spitchika
Path Finder

In both these cases you need to use input field token in your query like $Token$ to use it as variable.

kvnpichon
Path Finder

Hello,

I found a solution to my issue :

I used a time range picker and used the $time$ token.

In the source code of my dashboard (xml) I added 2 lines just after the query  :

<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>

So, now its looks like :

kvnpichon_0-1595922643868.png

Thanks for reply.

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...