How to create a dashboard on a custom field and add a timing filter on the custom field?

[aniello_cerrato]

Hi,

I have a problem with a dashboard. I have to create a timechart dashboard on a custom field (that is not index time) and also add a timing filter on this custom field.

I have created the dashboard in the following way:

| eval _time=strftime(myfield,....) | timechart ...

But when I add input time and it filters on original _time and not new time.

Please let me know.

Thanks,
Aniello

[somesoni2]

That's the limitation when you're not timecharting with original/splunk-extracted _time. The time range picker is applied on base search (before first pipe) and thus only works on _time available at that time. Since you're calculating your _time later (based on custom field), it won't honor the timerange picker.

Your option would be to explicitly set the time range picket to "All Time" OR something suitable length which will include all the data for your selected time range, and add time range filter using subsearch after you calculate your new _time. Something like this

index=foo sourcetype=bar .. earliest=0 latest=now | eval _time=strptime(customfield,"...timeformat..") | where _time>=[| gentimes start=-1 | addinfo | eval search=info_min_time | table search] AND _time<[| gentimes start=-1 | addinfo | eval search=info_max_time | table search] | ..rest of the search

[aniello_cerrato]

Hi,

in your search how can I add the filter time?Always using add input?