Dashboards & Visualizations

Dashboard earliest and latest Issue

akumar
Loves-to-Learn Lots


i have use-case to set the default dashboard time from Calendar day 26 to Business day 4 (e.g. Nov 26th to DEC 4th (4th business day in Dec)) this business day always changes from month to month, for example in Jan, 7th will be 4th business day of the month.
I have a lookup which lists the business days as "BD" and calendar days as "CD". I want to use those values and restrict the default dashboard view for each cycle. The dashboard should stick to the cycle(CD26 to BD4) and reset on every cycle of the month. If the dashboard is opened outside of the cycle i.e. 10th CD it should show results up to BD4 only.
i am trying to use below query, but unable to get correct results, I appreciate any help provided here.

| makeresults
| timechart span=1d count
| eval day=strftime(_time,"%d"),earliest=if(day>25,"@mon+25d","-1mon@mon+25d") ,today=strftime(_time,"%A")
| eval time=strftime(_time,"%Y-%m-%d") ,date=strftime(_time,"%Y%m%d")
| join type=left date
[| inputlookup abc.csv
| eval time=strptime(Date,"%m/%d/%Y"),date=strftime(time,"%Y%m%d")] |eval flag=case(BD=4 AND CD<26,C)
| eval latest=case(BD=4 AND CD<26,"@mon+".C."d")




Labels (1)
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...