Dashboards & Visualizations

text box input for date

frankagustinus
Explorer

I have a simple form that shows storage performance on a particular date using TimePicker.

But TimpePicker is not practical for my report form. I want a simple text box which I can simply key in "05/25/2014", click search, and my chart shows the storage performance on that date.

Is there a way to get that "05/25/2014" and put it into my search string ? Maybe some text-to-date conversion needed ? Or perhaps we put it not in search string but in the chart's parameter instead ?

Here is my current xml using TimePicker

<?xml version='1.0' encoding='utf-8'?>

<label>Storage Performance Report</label>

<fieldset>            
    <input type="time"></input>
</fieldset>

<searchTemplate>
    sourcetype="iostat" | multikv | search "c5t600A0B80006E23DE000003A74C3EA04Cd0" | timechart span=10m avg(usage)
</searchTemplate>

<row>   
    <chart>
        <title>Data File IOPS READ Detail</title>
        <option name="charting.chart">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.layout.splitSeries">false</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.primaryAxisTitle.text"/>
        <option name="charting.secondaryAxisTitle.text">READ IOPS</option>
    </chart>     
</row>

0 Karma

somesoni2
Revered Legend

Try this

<form>    
<label>Storage Performance Report</label>    
<fieldset>            
   <input type="text" token="varDate">
    <label>Enter Date(format %m/%d/%Y)</label>
    <default></default>
   </input>
</fieldset>

<searchTemplate>
sourcetype="iostat" [| stats count | eval date=if("$varDate$"="",strftime(now(),"%m/%d/%Y"),"$varDate$") 
  | eval earliest=strptime(date." 00:00","%m/%d/%Y %H:%M")  | eval latest=relative_time(earliest,"+1d")
  | table earliest, latest  | format "" "" "" "" "" ""]  | multikv | search "c5t600A0B80006E23DE000003A74C3EA04Cd0" | timechart span=10m avg(usage)
</searchTemplate>

<row>   
    <chart>
        <title>Data File IOPS READ Detail</title>
        <option name="charting.chart">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.layout.splitSeries">false</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.primaryAxisTitle.text"/>
        <option name="charting.secondaryAxisTitle.text">READ IOPS</option>
    </chart>     
</row>    

0 Karma

Chandras11
Communicator

Hi @somesoni2... This answer helped me with my code as well. However, I am wondering if we can have today's date in as well. I read somewhere about the to write the command but it's not working at my end.

Sorry for commenting on 4 years old post.

0 Karma

niketn
Legend

@Chandras11, refer to one of my recent answers to use HTML Date input with jQuery to allow search query to pick selected from the Date input: https://answers.splunk.com/answers/627432/jquery-datepicker-in-splunk.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Chandras11
Communicator

Thanks for it 🙂

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...