Dashboards & Visualizations

How to count all created_date and closed_date that lies within specified time picker range?

Nic
Engager

Hi all,

I'm new to Dashboard Studio and I'm running into an issue. I have two dates in my dataset: a created_date and a closed_date. I want to count all created_date that lies in the specified time picker range, and I want to do the same for closed_date.

Splunk automatically creates tokens, $global_time.earliest$ and $global_time.latest$. I tried to compare using these tokens, but this doesn't work:

| eval earliest = $global_time.earliest$
| eval latest = $global_time.latest$
| eval epochcreated_date =strptime(created_date, "%Y-%m-%dT%H:%M:%S.%3N%z")
| where epochcreated_date>= earliest AND epochcreated_date<= latest

I hope someone here can point me in the right direction. Thanks in advance.

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could try using the times that the search is actually using - these are provided by the addinfo command

| addinfo
| eval epochcreated_date =strptime(created_date, "%Y-%m-%dT%H:%M:%S.%3N%z")
| where epochcreated_date>= info_min_time AND epochcreated_date<= info_max_time

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try using the times that the search is actually using - these are provided by the addinfo command

| addinfo
| eval epochcreated_date =strptime(created_date, "%Y-%m-%dT%H:%M:%S.%3N%z")
| where epochcreated_date>= info_min_time AND epochcreated_date<= info_max_time
0 Karma

Nic
Engager

Thank you so much!!! This is exactly what I needed, awesome!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...