Dashboards & Visualizations

timepiker doesn't work correctly

almanacht
Explorer

Hi, it's just that I want to make a dashboard with a time menu but when I run it show me always the same Dashboard independant of the time how I choose, so I try to understand I wrote that:

| dbquery "MUSTER_BACKUP" "SELECT [submission_time],[submitter] FROM backup_db_jobs"
| eval mytime=strftime(submission_time,"%Y-%m-%d %H:%M:%S")
| eval s_time=strftime(_time,"%Y-%m-%d %H:%M:%S")
| eval _time=if(min(s_time) < mytime,s_time,mytime)
| eval pldetmpshumain=strftime(pldetmps,"%Y-%m-%d %H:%M:%S")

but when I start it (I try a lot of time with another notation) I see that the _time is always the same as the submission_time everyone know's what's going on ?

0 Karma
1 Solution

woodcock
Esteemed Legend

Here is a fun trick:

| dbquery "MUSTER_BACKUP" "SELECT [submission_time],[submitter] FROM backup_db_jobs"

| rename COMMENT AS "The Timepicker magic is here"
| addinfo
| where submission_time >= info_min_time AND submission_time <= info_max_time

| fieldformat mytime=strftime(submission_time,"%Y-%m-%d %H:%M:%S")
| fieldformat s_time=strftime(_time,"%Y-%m-%d %H:%M:%S")
| evenstats min(s_time) As min_s_time
| eval _time=if(min_s_time < mytime, s_time, mytime)
| eval pldetmpshumain=strftime(pldetmps,"%Y-%m-%d %H:%M:%S")

View solution in original post

woodcock
Esteemed Legend

Here is a fun trick:

| dbquery "MUSTER_BACKUP" "SELECT [submission_time],[submitter] FROM backup_db_jobs"

| rename COMMENT AS "The Timepicker magic is here"
| addinfo
| where submission_time >= info_min_time AND submission_time <= info_max_time

| fieldformat mytime=strftime(submission_time,"%Y-%m-%d %H:%M:%S")
| fieldformat s_time=strftime(_time,"%Y-%m-%d %H:%M:%S")
| evenstats min(s_time) As min_s_time
| eval _time=if(min_s_time < mytime, s_time, mytime)
| eval pldetmpshumain=strftime(pldetmps,"%Y-%m-%d %H:%M:%S")

almanacht
Explorer

Thank you a lot !!

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...