Is there a way to set the Time Range Picker to apply to another Time Date field (not _time)?

[jnuckolls0001]

Hello!

New to splunk. Trying to make a dashboard to find Change tickets in our enviornment to help with outage diagnostics. Long story short, I'd like to have the Time Range Picker apply to fields that contain dates, but not the _time field. There are two fields specifically, Start Date and End Date, that I would like to work with.

I'd like the Time Range picker to apply to the dates in the Start Date and End Date fields instead of _time. Is there any way to do this for one if not both fields?

[jnuckolls0001]

would a variable or token be involved in the | where command? Unsure how the second time picker would only apply to a specific field  with the where command...sorry if obvious, total scrub.

[ITWhisperer]

Yes and no

You could use another token or tokens for the where command or you could use the same one although I am not sure that would be particularly useful - it depends on your data

[jnuckolls0001]

Can you use the where command to replace the _time with the field I would like to work with? or would it just replace the name of the field and keep the same data? So something like:

| where _time = dv_end_date ?

I just tried it out and it didn't return any results so I'm most likely using it wrong or misunderstanding how to use | where in your context. 

[ITWhisperer]

The where command takes logical expressions i.e. either true or false - strictly speaking it would be |where _time == dv_end_date but Splunk is quite forgiving in this regard.

Perhaps you could share what it is you have tried so we can see if we can work out why it didn't work.

[ITWhisperer]

Yes and no

The initial search will retrieve events between an earliest time and a latest time. These times are chosen by the timepicker. They apply to the timestamp field of the events _time. So, whatever events you are interested in would have to fall between the earliest and latest times. (That's the no part)

However, you could then use a second timepicker to filter one or more of the fields using a where command. (That's the yes part)