Dashboards & Visualizations

Create dropdown of two-week range (gentimes)

sogeniusio
Path Finder

I'd like to create a dropdown that has two week spans. It should be formatted as follows:

01/01/2017 - 01/14/2017
01/15/2017 - 01/29/2017
...

I'd like to use this dropdown to group the data. I believe this could be accomplished with gentimes. I just don't know how to format the search.

0 Karma

mayurr98
Super Champion

hey you can try something like this

| gentimes start=01/01/2017  increment=14d | eval starthuman=strftime(starttime,"%m/%d/%Y") |eval endhuman=strftime(endtime,"%m/%d/%Y") | eval date=starthuman." - ".endhuman | fields date

let me know if this helps !

0 Karma

sogeniusio
Path Finder

Seems to work in a regular search but when I place it within the search for the dropdown it says it has conflicts due to duplicates.

0 Karma

sogeniusio
Path Finder

Your solution required some edits

| gentimes start=-240 increment=14d 
| eval starthuman=strftime(starttime,"%m/%d/%Y") 
| eval endhuman=strftime(endtime,"%m/%d/%Y")
| bin span=14d endtime
| eval date=starthuman." - ".endhuman 
| table date
| reverse

How would I go about using these values in my search?

0 Karma

mayurr98
Super Champion

yes, it looks fine just use sort instead of reverse.
Also to solve conflicts due to duplicates try this

    <input type="dropdown" token="field2" searchWhenChanged="true">
      <label>date</label>
      <fieldForLabel>field2</fieldForLabel>
      <fieldForValue>field2</fieldForValue>
      <search>
        <query>| gentimes start=-240 increment=14d 
 | eval starthuman=strftime(starttime,"%m/%d/%Y") 
 | eval endhuman=strftime(endtime,"%m/%d/%Y")
 | bin span=14d endtime
 | eval field2=starthuman." - ".endhuman 
 | table field2
 | sort field2</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>

field-label/value/token/and query field-name needs to be same.

0 Karma

somesoni2
Revered Legend

Do you calculate those two spans based on current date?

0 Karma

sogeniusio
Path Finder

Yes I'd like it to be calculated based on the current date. Since today is 1/18 the range should be 1/3 - 1/18

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...