Dashboards & Visualizations

Dashboard earliest and latest Issue

akumar
Loves-to-Learn Lots


i have use-case to set the default dashboard time from Calendar day 26 to Business day 4 (e.g. Nov 26th to DEC 4th (4th business day in Dec)) this business day always changes from month to month, for example in Jan, 7th will be 4th business day of the month.
I have a lookup which lists the business days as "BD" and calendar days as "CD". I want to use those values and restrict the default dashboard view for each cycle. The dashboard should stick to the cycle(CD26 to BD4) and reset on every cycle of the month. If the dashboard is opened outside of the cycle i.e. 10th CD it should show results up to BD4 only.
i am trying to use below query, but unable to get correct results, I appreciate any help provided here.

| makeresults
| timechart span=1d count
| eval day=strftime(_time,"%d"),earliest=if(day>25,"@mon+25d","-1mon@mon+25d") ,today=strftime(_time,"%A")
| eval time=strftime(_time,"%Y-%m-%d") ,date=strftime(_time,"%Y%m%d")
| join type=left date
[| inputlookup abc.csv
| eval time=strptime(Date,"%m/%d/%Y"),date=strftime(time,"%Y%m%d")] |eval flag=case(BD=4 AND CD<26,C)
| eval latest=case(BD=4 AND CD<26,"@mon+".C."d")




Labels (1)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...