Duration Filter without _time

[andrehl]

Hi Community!
I wanted to create a dashboard that have TWO filters assigned to a graph.

Date:                                              Duration:
2018-08-01                                         6months


My graph x-axis:



2018-03     2018-04    2018-05    2018-06    2018-07    2018-08

Be informed that I do not utilize the built-in Splunk _time system and thus I cannot use the _time input provided in the filter.

I tried using this as my filter code: - strptime("0000-06-00","%Y-%m-%d") but it didnt work.

Thanks guys!

[DalJeanis]

You probably want to use the relative_time() function to calculate your boundaries.

| eval new_time = relative_time(now(),"-6mon@mon")

[andrehl]

sorry, it didn't work for me

[niketn]

@andrehl you requirement for two inputs is not clear based on details provided. If Date input is not Splunk's Time Picker input, is it html time input?

If so please refer to one of my older answer to use html time input with jQuery (Simple XML JS Extension) to capture selected time and use in Splunk Dashboard as custom token: https://answers.splunk.com/answers/627432/jquery-datepicker-in-splunk.html

You would need to explain more about what is Duration filter? What are its possible values and how is Duration applied to searches along with Date? Is it a Combination of both Date and Duration or only one can be applied at a time?

Please elaborate with meaningful description and data.

[andrehl]

Hi @niketnilay, thank you for the feedback! Please pardon my unfamiliarity with programming languages.
My data came from excel files, similar to this:
Date_created
2017-05-13
2017-05-14
2017-07-14
2018-01-05

What I want to do is for the user to select filters (combination of both), Year: 2017 Month: 06, and Duration: Past 6 Months and my dashboard is supposed to only show datas from 2017 January to 2017 June.