Add a filter on time field in a dashboard (to search a specific day)

[kvnpichon]

Hello Splunkers,

I have created a dashboard about the number of events indexed per day (history).

This what it looks like :

My question is, how can I create a select/search field to be able to specify a date (format : YYYY-MM-DD) and display the number of events for this specific date  ?

For example I specify the "2020-07-26" date in the search field  and the dashboard must displays the only line with the date and the number of events at this date (Number of Events = 107119 in the example).

Hope you can help me,

Regards

[spitchika]

1# Best way is, populate all your _time into Dropdown input and select from there. You can just include dropdown and in search string you can give a query to populate dates (I think you already have that query based on your screenshot)

2# in case your dates are too many then its difficult to select from drop down, in that case you can go with "Textbox" input type, It will act as variable in programming language :).

[spitchika]

In both these cases you need to use input field token in your query like $Token$ to use it as variable.

[kvnpichon · Accepted solution]

Hello,

I found a solution to my issue :

I used a time range picker and used the $time$ token.

In the source code of my dashboard (xml) I added 2 lines just after the query  :

<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>

So, now its looks like :

Thanks for reply.