I am trying to define specific dates to search in a dashboard based on fiscal months, which of course don't match a typical month. Currently, I am using the time picker and selecting the dates. This will speed things up for generating views.
For example:
fiscal month September could be - 8/25/18 to 10/25/18
fiscal month October could be - 9/25/18 to 10/25/18
It could be dropdown that just shows the name of the month and when selected defines the earliest and latest values. Any help is appreciated.
-Don
you can maintain the "fiscal month","from date" and "To date" mapping in a lookup.
refer the lookup when user selects a particular fiscal month from drop dow.
for eg your look up has columns as
Month From To
Sep 8/25/2018 9/25/2018
when you get the value of From and to date, use strptime to convert into splunk time format ,
eval earliest=strptime(From,"%m/%d/%Y")
eval latest= strptime(To,"%m/%d/%Y")
Once you get earliest and latest time value, assign it to a token and refer the token within your search query and tags