I am trying to create a dashboard from a lookup file that has fields:
Ticket_ID
Open_Date
Close_Date
Description
I am having the hardest time trying to get the Time input field to reference the Open_Date so that it's easier to search for certain tickets between a certain date from a dashboard. I have tried eval _time=Open_Date but that didn't work for me. Any ideas?
Below is a sample of the fields:
Ticket_ID = 123
Open_Date = 9/4/2014 9:07:29 AM
Close_Date = 9/5/2014 9:07:29 AM
Description = This is an example.
The time selector criteria of a search will only run on the _time value of the raw events - which don't exist here since you have a lookup file.
Your options:
If still is no good, we can talk about the goal of the dashboard itself and make sure that we haven't overlooked a different solution all together.
The time selector criteria of a search will only run on the _time value of the raw events - which don't exist here since you have a lookup file.
Your options:
If still is no good, we can talk about the goal of the dashboard itself and make sure that we haven't overlooked a different solution all together.
Try something like this. This should give only the results where Open_Date values are between selected time range.
| inputlookup yourLookupTable.csv | eval _time=strptime(Open_Date,"%m/%d/%Y %H:%M:%S %p") | search _time>=[| gentimes start=-1 | eval search=info_min_time | table search] AND _time<[| gentimes start=-1 | eval search=info_max_time | table search]
OR
| inputlookup yourLookupTable.csv | eval filterdate=strftime(strptime(Open_Date,"%m/%d/%Y %H:%M:%S %p"),"%m/%d/%Y:%H:%M:%S") | search filter>=[| gentimes start=-1 | eval search=strftime(info_min_time,"%m/%d/%Y:%H:%M:%S") | table search] AND filter<[| gentimes start=-1 | eval search=strftime(info_max_time,"%m/%d/%Y:%H:%M:%S") | table search]
I understand how to find events between dates, but I am trying to see if its possible for me to use the Time input box on a dashboard for my lookup file even though I set my Open_Date field as _time.
I think _time needs to be in epoch form. Try eval _time=strptime(Open_Date,"%m/%d/%Y %H:%M:%S %p")
.
Unfortunately, I have already tried that and it didn't work.