Dashboards & Visualizations

Create dropdown of two-week range (gentimes)

sogeniusio
Path Finder

I'd like to create a dropdown that has two week spans. It should be formatted as follows:

01/01/2017 - 01/14/2017
01/15/2017 - 01/29/2017
...

I'd like to use this dropdown to group the data. I believe this could be accomplished with gentimes. I just don't know how to format the search.

0 Karma

mayurr98
Super Champion

hey you can try something like this

| gentimes start=01/01/2017  increment=14d | eval starthuman=strftime(starttime,"%m/%d/%Y") |eval endhuman=strftime(endtime,"%m/%d/%Y") | eval date=starthuman." - ".endhuman | fields date

let me know if this helps !

0 Karma

sogeniusio
Path Finder

Seems to work in a regular search but when I place it within the search for the dropdown it says it has conflicts due to duplicates.

0 Karma

sogeniusio
Path Finder

Your solution required some edits

| gentimes start=-240 increment=14d 
| eval starthuman=strftime(starttime,"%m/%d/%Y") 
| eval endhuman=strftime(endtime,"%m/%d/%Y")
| bin span=14d endtime
| eval date=starthuman." - ".endhuman 
| table date
| reverse

How would I go about using these values in my search?

0 Karma

mayurr98
Super Champion

yes, it looks fine just use sort instead of reverse.
Also to solve conflicts due to duplicates try this

    <input type="dropdown" token="field2" searchWhenChanged="true">
      <label>date</label>
      <fieldForLabel>field2</fieldForLabel>
      <fieldForValue>field2</fieldForValue>
      <search>
        <query>| gentimes start=-240 increment=14d 
 | eval starthuman=strftime(starttime,"%m/%d/%Y") 
 | eval endhuman=strftime(endtime,"%m/%d/%Y")
 | bin span=14d endtime
 | eval field2=starthuman." - ".endhuman 
 | table field2
 | sort field2</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>

field-label/value/token/and query field-name needs to be same.

0 Karma

somesoni2
Revered Legend

Do you calculate those two spans based on current date?

0 Karma

sogeniusio
Path Finder

Yes I'd like it to be calculated based on the current date. Since today is 1/18 the range should be 1/3 - 1/18

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...