Dashboards & Visualizations

How to create a dashboard on a custom field and add a timing filter on the custom field?

Path Finder


I have a problem with a dashboard. I have to create a timechart dashboard on a custom field (that is not index time) and also add a timing filter on this custom field.

I have created the dashboard in the following way:

| eval _time=strftime(myfield,....) | timechart ...

But when I add input time and it filters on original _time and not new time.

Please let me know.


0 Karma

Revered Legend

That's the limitation when you're not timecharting with original/splunk-extracted _time. The time range picker is applied on base search (before first pipe) and thus only works on _time available at that time. Since you're calculating your _time later (based on custom field), it won't honor the timerange picker.

Your option would be to explicitly set the time range picket to "All Time" OR something suitable length which will include all the data for your selected time range, and add time range filter using subsearch after you calculate your new _time. Something like this

index=foo sourcetype=bar .. earliest=0 latest=now | eval _time=strptime(customfield,"...timeformat..") | where _time>=[| gentimes start=-1 | addinfo | eval search=info_min_time | table search] AND _time<[| gentimes start=-1 | addinfo | eval search=info_max_time | table search] | ..rest of the search
0 Karma

Path Finder


in your search how can I add the filter time?Always using add input?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...