I'd like to create a dropdown that has two week spans. It should be formatted as follows:
01/01/2017 - 01/14/2017
01/15/2017 - 01/29/2017
...
I'd like to use this dropdown to group the data. I believe this could be accomplished with gentimes. I just don't know how to format the search.
hey you can try something like this
| gentimes start=01/01/2017 increment=14d | eval starthuman=strftime(starttime,"%m/%d/%Y") |eval endhuman=strftime(endtime,"%m/%d/%Y") | eval date=starthuman." - ".endhuman | fields date
let me know if this helps !
Seems to work in a regular search but when I place it within the search for the dropdown it says it has conflicts due to duplicates.
Your solution required some edits
| gentimes start=-240 increment=14d
| eval starthuman=strftime(starttime,"%m/%d/%Y")
| eval endhuman=strftime(endtime,"%m/%d/%Y")
| bin span=14d endtime
| eval date=starthuman." - ".endhuman
| table date
| reverse
How would I go about using these values in my search?
yes, it looks fine just use sort
instead of reverse
.
Also to solve conflicts due to duplicates
try this
<input type="dropdown" token="field2" searchWhenChanged="true">
<label>date</label>
<fieldForLabel>field2</fieldForLabel>
<fieldForValue>field2</fieldForValue>
<search>
<query>| gentimes start=-240 increment=14d
| eval starthuman=strftime(starttime,"%m/%d/%Y")
| eval endhuman=strftime(endtime,"%m/%d/%Y")
| bin span=14d endtime
| eval field2=starthuman." - ".endhuman
| table field2
| sort field2</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
field-label/value/token/and query field-name needs to be same.
Do you calculate those two spans based on current date?
Yes I'd like it to be calculated based on the current date. Since today is 1/18 the range should be 1/3 - 1/18