Dashboards & Visualizations

Create dropdown of two-week range (gentimes)

sogeniusio
Path Finder

I'd like to create a dropdown that has two week spans. It should be formatted as follows:

01/01/2017 - 01/14/2017
01/15/2017 - 01/29/2017
...

I'd like to use this dropdown to group the data. I believe this could be accomplished with gentimes. I just don't know how to format the search.

0 Karma

mayurr98
Super Champion

hey you can try something like this

| gentimes start=01/01/2017  increment=14d | eval starthuman=strftime(starttime,"%m/%d/%Y") |eval endhuman=strftime(endtime,"%m/%d/%Y") | eval date=starthuman." - ".endhuman | fields date

let me know if this helps !

0 Karma

sogeniusio
Path Finder

Seems to work in a regular search but when I place it within the search for the dropdown it says it has conflicts due to duplicates.

0 Karma

sogeniusio
Path Finder

Your solution required some edits

| gentimes start=-240 increment=14d 
| eval starthuman=strftime(starttime,"%m/%d/%Y") 
| eval endhuman=strftime(endtime,"%m/%d/%Y")
| bin span=14d endtime
| eval date=starthuman." - ".endhuman 
| table date
| reverse

How would I go about using these values in my search?

0 Karma

mayurr98
Super Champion

yes, it looks fine just use sort instead of reverse.
Also to solve conflicts due to duplicates try this

    <input type="dropdown" token="field2" searchWhenChanged="true">
      <label>date</label>
      <fieldForLabel>field2</fieldForLabel>
      <fieldForValue>field2</fieldForValue>
      <search>
        <query>| gentimes start=-240 increment=14d 
 | eval starthuman=strftime(starttime,"%m/%d/%Y") 
 | eval endhuman=strftime(endtime,"%m/%d/%Y")
 | bin span=14d endtime
 | eval field2=starthuman." - ".endhuman 
 | table field2
 | sort field2</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>

field-label/value/token/and query field-name needs to be same.

0 Karma

somesoni2
Revered Legend

Do you calculate those two spans based on current date?

0 Karma

sogeniusio
Path Finder

Yes I'd like it to be calculated based on the current date. Since today is 1/18 the range should be 1/3 - 1/18

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...