Dashboards & Visualizations

Create dropdown of two-week range (gentimes)

sogeniusio
Path Finder

I'd like to create a dropdown that has two week spans. It should be formatted as follows:

01/01/2017 - 01/14/2017
01/15/2017 - 01/29/2017
...

I'd like to use this dropdown to group the data. I believe this could be accomplished with gentimes. I just don't know how to format the search.

0 Karma

mayurr98
Super Champion

hey you can try something like this

| gentimes start=01/01/2017  increment=14d | eval starthuman=strftime(starttime,"%m/%d/%Y") |eval endhuman=strftime(endtime,"%m/%d/%Y") | eval date=starthuman." - ".endhuman | fields date

let me know if this helps !

0 Karma

sogeniusio
Path Finder

Seems to work in a regular search but when I place it within the search for the dropdown it says it has conflicts due to duplicates.

0 Karma

sogeniusio
Path Finder

Your solution required some edits

| gentimes start=-240 increment=14d 
| eval starthuman=strftime(starttime,"%m/%d/%Y") 
| eval endhuman=strftime(endtime,"%m/%d/%Y")
| bin span=14d endtime
| eval date=starthuman." - ".endhuman 
| table date
| reverse

How would I go about using these values in my search?

0 Karma

mayurr98
Super Champion

yes, it looks fine just use sort instead of reverse.
Also to solve conflicts due to duplicates try this

    <input type="dropdown" token="field2" searchWhenChanged="true">
      <label>date</label>
      <fieldForLabel>field2</fieldForLabel>
      <fieldForValue>field2</fieldForValue>
      <search>
        <query>| gentimes start=-240 increment=14d 
 | eval starthuman=strftime(starttime,"%m/%d/%Y") 
 | eval endhuman=strftime(endtime,"%m/%d/%Y")
 | bin span=14d endtime
 | eval field2=starthuman." - ".endhuman 
 | table field2
 | sort field2</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>

field-label/value/token/and query field-name needs to be same.

0 Karma

somesoni2
Revered Legend

Do you calculate those two spans based on current date?

0 Karma

sogeniusio
Path Finder

Yes I'd like it to be calculated based on the current date. Since today is 1/18 the range should be 1/3 - 1/18

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...