Getting Data In

Can we add more than one time field to the dataset or add more than one time filter to the pivot?

chinmayc469
Explorer

I have created a pivot report which by default has _time filter, but I want to apply a filter on my other date-time fields also.

I tried doing this, but it is taking my other date-time fields as strings and not as date.

I want to add more than one time filter to the pivot report and all time filters should have the capability to select range of values.

Thanks in advance.

0 Karma

DalJeanis
Legend

In your search, you need to create an epoch version of each time field you want to filter on. Assuming the time selector was called start_token and the field was StartTime, in a format like "2018-08-01 14:21:00", it might look like this in the search...

 | eval StartTimeEpoch=strptime(StartTime,"%Y-%m-%d %H:%M:%S")
 | where StartTimeEpoch>= $start_token.earliest$ AND StartTimeEpoch < $start_token.latest$ 
0 Karma

chinmayc469
Explorer

but how to do this in pivot report?

0 Karma
Get Updates on the Splunk Community!

Alpha Launch: AI-Assisted Auto-Schematization for CIM

Streamlining Data Onboarding: Announcing the Alpha Release of AI-Assisted Auto-Schematization For many Splunk ...

Enterprise Security(ES) Essentials or Premier? Let's discuss Splunk ES Editions on ...

  Hi everyone, Last year at .conf25, we shared something exciting: Splunk Enterprise Security is evolving ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 5

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...