Can you deploy year wise filter in the splunk dashboard?

[shailesh069]

I get the string and match the string but it has to go through all the database , so getting performance issue

[shailesh069]

@FrankVl But this " earliest="1/1/2018:00:00:00" latest="1/1/2019:00:00:00" " is hardcoded. I want a dropdown in the dashoard , in which if I select "2019" is in dropdown then it should filter the data in the dashboard according to that year. How can we do it.

What I did is I created a dropdown with the "2019", "2018", "2017" after that when user click it, I am doing my filter. So this way it has to see whole events to extract. But what I wan to do is when user clicks the "2019" the events restricted itself to the "2019" events

[FrankVl]

Then define a dropdown with those years as names and the respective earliest/latest filters as values. Assign a token and use that token in your dashboard's search query.

[shailesh069]

@FrankVl Thanks a lot , I got it. I will try this.

[FrankVl]

Good luck. I changed my earlier comment to an answer and added this part as well. If it works for you, please mark that answer as accepted 🙂

[FrankVl · Accepted solution]

@shailesh069 can you share your current search, so we can help you improve it?

Should be as simple as: earliest="1/1/2018:00:00:00" latest="1/1/2019:00:00:00" to get all events from 2018.

Edit: for integrating that in a dashboard with a dropdown: Define a dropdown with the desired selection of years as names and the respective earliest/latest filters as values. Assign a token and use that token in your dashboard's search query.

[p_gurav]

Did you try using splunk internal field called date_year?

[FrankVl]

That is dangerous as it will only be available when splunk parses the time from the event content. If you have data sources where you use "current time" for the timestamp, it will not have those date_ fields. Also, those field can be disabled (for performance reasons).