Dashboards & Visualizations

text box input for date

frankagustinus
Explorer

I have a simple form that shows storage performance on a particular date using TimePicker.

But TimpePicker is not practical for my report form. I want a simple text box which I can simply key in "05/25/2014", click search, and my chart shows the storage performance on that date.

Is there a way to get that "05/25/2014" and put it into my search string ? Maybe some text-to-date conversion needed ? Or perhaps we put it not in search string but in the chart's parameter instead ?

Here is my current xml using TimePicker

<?xml version='1.0' encoding='utf-8'?>

<label>Storage Performance Report</label>

<fieldset>            
    <input type="time"></input>
</fieldset>

<searchTemplate>
    sourcetype="iostat" | multikv | search "c5t600A0B80006E23DE000003A74C3EA04Cd0" | timechart span=10m avg(usage)
</searchTemplate>

<row>   
    <chart>
        <title>Data File IOPS READ Detail</title>
        <option name="charting.chart">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.layout.splitSeries">false</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.primaryAxisTitle.text"/>
        <option name="charting.secondaryAxisTitle.text">READ IOPS</option>
    </chart>     
</row>

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

<form>    
<label>Storage Performance Report</label>    
<fieldset>            
   <input type="text" token="varDate">
    <label>Enter Date(format %m/%d/%Y)</label>
    <default></default>
   </input>
</fieldset>

<searchTemplate>
sourcetype="iostat" [| stats count | eval date=if("$varDate$"="",strftime(now(),"%m/%d/%Y"),"$varDate$") 
  | eval earliest=strptime(date." 00:00","%m/%d/%Y %H:%M")  | eval latest=relative_time(earliest,"+1d")
  | table earliest, latest  | format "" "" "" "" "" ""]  | multikv | search "c5t600A0B80006E23DE000003A74C3EA04Cd0" | timechart span=10m avg(usage)
</searchTemplate>

<row>   
    <chart>
        <title>Data File IOPS READ Detail</title>
        <option name="charting.chart">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.layout.splitSeries">false</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.primaryAxisTitle.text"/>
        <option name="charting.secondaryAxisTitle.text">READ IOPS</option>
    </chart>     
</row>    

0 Karma

Chandras11
Communicator

Hi @somesoni2... This answer helped me with my code as well. However, I am wondering if we can have today's date in as well. I read somewhere about the to write the command but it's not working at my end.

Sorry for commenting on 4 years old post.

0 Karma

niketn
Legend

@Chandras11, refer to one of my recent answers to use HTML Date input with jQuery to allow search query to pick selected from the Date input: https://answers.splunk.com/answers/627432/jquery-datepicker-in-splunk.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Chandras11
Communicator

Thanks for it 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...