I have a simple form that shows storage performance on a particular date using TimePicker.
But TimpePicker is not practical for my report form. I want a simple text box which I can simply key in "05/25/2014", click search, and my chart shows the storage performance on that date.
Is there a way to get that "05/25/2014" and put it into my search string ? Maybe some text-to-date conversion needed ? Or perhaps we put it not in search string but in the chart's parameter instead ?
Here is my current xml using TimePicker
<?xml version='1.0' encoding='utf-8'?>
<form> <label>Storage Performance Report</label> <fieldset> <input type="text" token="varDate"> <label>Enter Date(format %m/%d/%Y)</label> <default></default> </input> </fieldset> <searchTemplate> sourcetype="iostat" [| stats count | eval date=if("$varDate$"="",strftime(now(),"%m/%d/%Y"),"$varDate$") | eval earliest=strptime(date." 00:00","%m/%d/%Y %H:%M") | eval latest=relative_time(earliest,"+1d") | table earliest, latest | format "" "" "" "" "" ""] | multikv | search "c5t600A0B80006E23DE000003A74C3EA04Cd0" | timechart span=10m avg(usage) </searchTemplate> <row> <chart> <title>Data File IOPS READ Detail</title> <option name="charting.chart">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.layout.splitSeries">false</option> <option name="charting.legend.placement">right</option> <option name="charting.primaryAxisTitle.text"/> <option name="charting.secondaryAxisTitle.text">READ IOPS</option> </chart> </row>
Hi @somesoni2... This answer helped me with my code as well. However, I am wondering if we can have today's date in as well. I read somewhere about the to write the command but it's not working at my end.
Sorry for commenting on 4 years old post.
@Chandras11, refer to one of my recent answers to use HTML Date input with jQuery to allow search query to pick selected from the Date input: https://answers.splunk.com/answers/627432/jquery-datepicker-in-splunk.html