How to create a custom filter with months in the dashboard?

[Drake_IT]

I would like to create a time filter in my dashboard based on Month reports, something like below:

But each month time frame should be customized on this way:

January -> Between 15/12/2022 (previous year) and 05/01/2023 (current year)

February -> Between 15/01/2023 and 05/02/2023

March -> Between 15/02/2023 and 05/03/2023

....

This should be used to filter the data presented on the dashboard based on the month selected.

[gcusello]

Hi @Drake_IT,

this is possible creating a lookup containing at least three columns:

• Month
• StartTime
• EndTime

Then you can use these column to associate the "Month" field to each event and then run a statistic.

Could you share some sample of your data?

Then I don't understand how you manage the missing periods, e.g. from 06/01/2023 and 14/01/2023.

Ciao.

Giuseppe

[Drake_IT · Accepted solution]

Hi @gcusello ,

Thank you for your help. I was able to get to a solution on this way:

I created a dataset with the months and the range dates that I needed:

Then using the dropdown created with the months that can be selected by the user I added a sub search to each panel on the dashboard using that as a filter (based on the token from the dropdown).

[search index=index_used | head 1 | fillnull value="" | eval month="$month_search$" | eval year=strftime(_time,"%Y") | lookup Months.csv Month as month OUTPUT Start_Date as RR_Start_Date, End_Date as RR_End_Date | eval latest=RR_End_Date.year | eval year=if(month="January", year - 1, year) | eval earliest=RR_Start_Date.year | eval earliest=strptime(earliest,"%m/%d/%Y") | eval latest=strptime(latest,"%m/%d/%Y") | table earliest, latest | format "" "" "" "" "" ""]

Regarding your question:

Then I don't understand how you manage the missing periods, e.g. from 06/01/2023 and 14/01/2023 -> On that period we don't have data that should be used on the report.

Thank you!

[gcusello]

Hi @Drake_IT,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉