Dashboards & Visualizations

Applying token to date time functions in a dashboard

PB
Loves-to-Learn Lots

Looking to build an interactive dashboard from csv file which contains timestamp. 

If we select last 7 days, am looking to filter 19th May to 13th May of data from this below sample table. 

Sample data: 

_timeIndexSourcetype
19-05-2024 05:30xy
18-05-2024 05:30xy
...  

 

One of the input am planning is Time frame, so if i've to pass the token to the panels am trying to use |eval Time=relative_time(now(),"$time_tok$") which is not working as time token comes with earliest and latest timestamps. So, I've tried strptime to convert but still no luck over there. 

Can someone suggest a better way? 

 

Labels (1)
0 Karma

KendallW
Contributor

Hi @PB Could you please share your dashboard's XML?

If I understand correctly, you want to pick a time range using Splunk's time picker on the dashboard, then have data from the CSV (lookup?) file returned by a search where the _time column in the CSV falls within the range specified in the time picker?

0 Karma

PB
Loves-to-Learn Lots

Hi @KendallW 
yes, that's exactly right. _time is one of the columns in a lookup file.

And I want to choose the _time range from Lookup file using the time picker in Splunk dashboard. 

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...