How to add text fields to dashboard to specify start and end time filter ?

[iamsplunker31]

We have a dashboard and wanted to add text fields to enter start date with time and end date with time say
(11/13/2019 08:00 pm - 11/14/2019 10:00 AM) so that dashboard should be updated according to the time period.

[vnravikumar · Accepted solution]

Hi

Try this, i didn't added validation for date/time field.

<form>
  <label>filter</label>
  <fieldset submitButton="false">
    <input type="text" token="startdate" searchWhenChanged="true">
      <label>Start Date (mm/dd/yyyy hh:mm AM/PM)</label>
      <change>
        <condition>
          <eval token="new_earliest">strptime(startdate,"%m/%d/%Y %H:%M %p")</eval>
        </condition>
      </change>
    </input>
    <input type="text" token="enddate" searchWhenChanged="true">
      <label>End Date  Start Date (mm/dd/yyyy hh:mm AM/PM)</label>
      <change>
        <condition>
          <eval token="new_latest">strptime(enddate,"%m/%d/%Y %H:%M %p")</eval>
        </condition>
      </change>
    </input>
  </fieldset>
  <row depends="$startdate$ $enddate$">
    <panel>
      <table>
        <search>
          <query>index=_internal earliest=$new_earliest$ latest=$new_latest$ |stats count by action, host</query>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

[iamsplunker31]

Hi @vnravikumar, Thank you for your response.
The start time and end time works fine but our base search pulling the resullts for current, last 7 days ,14 days , 21 days , 28 days . If we select the start and end time say (10/13/2019 10:00 - 10/13/2019 11:00). It's pulling the results along with current, last 7 days , 14 days .. with the time period (10-11). We only need to pull the data for selected time period. Here is our base query

| multisearch
[ search index=foo sourcetype=bar earliest=-0d@d latest=now
| eval label="Colomn1"
| fields -_raw _time apple label ]
[ search index=foo sourcetype=bar earliest=-7d@d latest=-7d@d
| eval _time=_time+60*60*24*7
| eval label="Colomn2"
| fields -_raw _time apple label ]
[ search index=foo sourcetype=bar earliest=-14d@d latest=-14d@d
| eval _time=_time+60*60*24*14
| eval label="Colomn3"
| fields -_raw _time apple label ]
[ search index=foo sourcetype=bar earliest=-21@d latest=-21@d
| eval _time=_time+60*60*24*21
| eval label="Colomn4"
| fields -_raw _time apple label ]
[ search index=foo sourcetype=bar earliest=-28@d latest=-28@d
| eval _time=_time+60*60*24*28
| eval label="Colomn5"
| fields -_raw _time apple label]
| bin _time span=5m
| chart dc(apple) over _time by label
| eval "Colomn1 4 Week Avg"=('Colomn2'+Colomn3+Colomn4+Colomn5)/4
| eval "Colomn2 4 Week Avg"=abs('Colomn2'-'Colomn1')
| eval "Diff of Colomn1 and 4 Week Avg."=abs('Colomn5'-'Colomn1')
| eval Est_Impact= abs('Diff of Colomn1 and Colomn2'-'Colomn5.')
| fields _time "Colomn1" "Colomn2" "Colomn3" "Colomn4" "Colomn5"
|search colomn1!=0