Dashboards & Visualizations

How to pass the date parameter in a query

aditsss
Motivator

Hi Everyone,

I have one requirement:

I have one date drop down like this:

<input type="time" token="field1">
<label>Date/Time</label>
<default>
<earliest>-7d@d</earliest>
<latest>now</latest>
</default>
</input>

And one panel query as below:

I need to know how can I pass $field1.earliest$ and $field1.latest$ in nowdate.(highlighted in bold)

<chart>
<search>
<query>|inputlookup JOB_MDJX_CS_EXTR_STATS_2.csv|append [ inputlookup JOB_MDJX_CS_EXTR_STATS_2_E2.csv]|append [ inputlookup JOB_MDJX_CS_EXTR_STATS_2_E3.csv]|where Environment="$Env$"|where JOBFLOW_ID LIKE "%$Src_Jb_Id$%"|eval Run_date1="20".RUNDATE2
|eval Run_Date=strptime(Run_date1,"%Y%m%d")
|eval nowdate=relative_time(now(), "-7d@d")|fieldformat nowdate=strftime(nowdate,"%d/%b/%Y")
|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")
|where Run_Date&gt;=nowdate|stats sum(REC_COUNT) by Run_Date</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this:

<chart>
<search>
<query>|inputlookup JOB_MDJX_CS_EXTR_STATS_2.csv|append [ inputlookup JOB_MDJX_CS_EXTR_STATS_2_E2.csv]|append [ inputlookup JOB_MDJX_CS_EXTR_STATS_2_E3.csv]|where Environment="$Env$"|where JOBFLOW_ID LIKE "%$Src_Jb_Id$%"|eval Run_date1="20".RUNDATE2
|eval Run_Date=strptime(Run_date1,"%Y%m%d")
|eval nowdate=relative_time(now(), "$field1.earliest$")|fieldformat nowdate=strftime(nowdate,"%d/%b/%Y")
|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")
|where Run_Date&gt;=nowdate|stats sum(REC_COUNT) by Run_Date</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try this:

<chart>
<search>
<query>|inputlookup JOB_MDJX_CS_EXTR_STATS_2.csv|append [ inputlookup JOB_MDJX_CS_EXTR_STATS_2_E2.csv]|append [ inputlookup JOB_MDJX_CS_EXTR_STATS_2_E3.csv]|where Environment="$Env$"|where JOBFLOW_ID LIKE "%$Src_Jb_Id$%"|eval Run_date1="20".RUNDATE2
|eval Run_Date=strptime(Run_date1,"%Y%m%d")
|eval nowdate=relative_time(now(), "$field1.earliest$")|fieldformat nowdate=strftime(nowdate,"%d/%b/%Y")
|fieldformat Run_Date=strftime(Run_Date,"%d/%b/%Y")
|where Run_Date&gt;=nowdate|stats sum(REC_COUNT) by Run_Date</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...