Dashboards & Visualizations

Create dropdown of two-week range (gentimes)

sogeniusio
Path Finder

I'd like to create a dropdown that has two week spans. It should be formatted as follows:

01/01/2017 - 01/14/2017
01/15/2017 - 01/29/2017
...

I'd like to use this dropdown to group the data. I believe this could be accomplished with gentimes. I just don't know how to format the search.

0 Karma

mayurr98
Super Champion

hey you can try something like this

| gentimes start=01/01/2017  increment=14d | eval starthuman=strftime(starttime,"%m/%d/%Y") |eval endhuman=strftime(endtime,"%m/%d/%Y") | eval date=starthuman." - ".endhuman | fields date

let me know if this helps !

0 Karma

sogeniusio
Path Finder

Seems to work in a regular search but when I place it within the search for the dropdown it says it has conflicts due to duplicates.

0 Karma

sogeniusio
Path Finder

Your solution required some edits

| gentimes start=-240 increment=14d 
| eval starthuman=strftime(starttime,"%m/%d/%Y") 
| eval endhuman=strftime(endtime,"%m/%d/%Y")
| bin span=14d endtime
| eval date=starthuman." - ".endhuman 
| table date
| reverse

How would I go about using these values in my search?

0 Karma

mayurr98
Super Champion

yes, it looks fine just use sort instead of reverse.
Also to solve conflicts due to duplicates try this

    <input type="dropdown" token="field2" searchWhenChanged="true">
      <label>date</label>
      <fieldForLabel>field2</fieldForLabel>
      <fieldForValue>field2</fieldForValue>
      <search>
        <query>| gentimes start=-240 increment=14d 
 | eval starthuman=strftime(starttime,"%m/%d/%Y") 
 | eval endhuman=strftime(endtime,"%m/%d/%Y")
 | bin span=14d endtime
 | eval field2=starthuman." - ".endhuman 
 | table field2
 | sort field2</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>

field-label/value/token/and query field-name needs to be same.

0 Karma

somesoni2
Revered Legend

Do you calculate those two spans based on current date?

0 Karma

sogeniusio
Path Finder

Yes I'd like it to be calculated based on the current date. Since today is 1/18 the range should be 1/3 - 1/18

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...