Dashboards & Visualizations

filter a field based on a time picker (handling of special now / all time cases)

sylbaea
Communicator

Hello,

I have a query where I need to filter a date DateOpen_EPOC (already in EPOC format) with a time picker (token is date_open). This time picker is not linked to default _time.

From a past question on the forum, I got this which works fine in most of the case:

(...)
| where DateOpen_EPOC >= if(replace("$date_open.earliest$","\d","")!="",relative_time(now(),"$date_open.earliest$"),"$date_open.earliest$")  
AND  DateOpen_EPOC >= if(replace("$date_open.latest$","\d","")!="",relative_time(now(),"$date_open.latest$"),"$date_open.latest$")  
(...)

However this query does not work in (at least) in two specific cases:
- Time Picker = "All time" --> in that case, it looks $date_open.earliest$ and $date_open.latest$ return nothing and it does not work
- Time Picker = "Last 7 days" (for instance). Here $date_open.latest$ equals now and it does not work

Any suggestion to improve (or replace) this query to truly manage all cases ?
Thanks.

0 Karma

woodcock
Esteemed Legend

Like this (NOTE: one of your > should surely have been <😞

(...)
| addinfo | where DateOpen_EPOC>=info_min_time AND DateOpen_EPOC<=info_max_time
(...)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...