Getting Data In

Can we add more than one time field to the dataset or add more than one time filter to the pivot?

chinmayc469
Explorer

I have created a pivot report which by default has _time filter, but I want to apply a filter on my other date-time fields also.

I tried doing this, but it is taking my other date-time fields as strings and not as date.

I want to add more than one time filter to the pivot report and all time filters should have the capability to select range of values.

Thanks in advance.

0 Karma

DalJeanis
Legend

In your search, you need to create an epoch version of each time field you want to filter on. Assuming the time selector was called start_token and the field was StartTime, in a format like "2018-08-01 14:21:00", it might look like this in the search...

 | eval StartTimeEpoch=strptime(StartTime,"%Y-%m-%d %H:%M:%S")
 | where StartTimeEpoch>= $start_token.earliest$ AND StartTimeEpoch < $start_token.latest$ 
0 Karma

chinmayc469
Explorer

but how to do this in pivot report?

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...