How to create a dropdown with custom time range?

[karthi25]

I am having the field StartDate in the splunk log, My search should based on the startDate field instead of event date.
For example,
I have the even date as "31-01-2018 09:23:23" and the data as below:

{"StartDate":"2018-01-31 03:30:14.0",splunkId=123, processLogId=12, processName='abc'}
{"StartDate":"2018-01-31 03:25:14.0",splunkId=345, processLogId=12, processName='abc'}
{"StartDate":"2018-01-30 01:30:14.0",splunkId=456, processLogId=12, processName='abc'}
{"StartDate":"2018-01-29 01:30:14.0",splunkId=678, processLogId=12, processName='abc'}
{"StartDate":"2017-12-31 03:30:14.0",splunkId=12123, processLogId=12, processName='abc'}
{"StartDate":"2017-12-31 03:25:14.0",splunkId=12345, processLogId=12, processName='abc'}
{"StartDate":"2017-12-30 01:30:14.0",splunkId=12456, processLogId=12, processName='abc'}
{"StartDate":"2017-12-29 01:30:14.0",splunkId=12678, processLogId=12, processName='abc'}

Now if I select last 7 days in the dropdown the search should be based on startDate , then it would returns as follows:

{"StartDate":"2018-01-31 03:30:14.0",splunkId=123, processLogId=12, processName='abc'}
{"StartDate":"2018-01-31 03:25:14.0",splunkId=345, processLogId=12, processName='abc'}
{"StartDate":"2018-01-30 01:30:14.0",splunkId=456, processLogId=12, processName='abc'}
{"StartDate":"2018-01-29 01:30:14.0",splunkId=678, processLogId=12, processName='abc'}

Can anyone please help me to do it.

[mayurr98]

have you set Splunk timestamp to be start date while indexing?

If NOT then you have to make your Splunk timestamp to take startdate, for that you can make below configurations in props.conf

[<your_sourcetype>]
DATETIME_CONFIG =
MAX_TIMESTAMP_LOOKAHEAD = 30
NO_BINARY_CHECK = true
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%N
TIME_PREFIX = StartDate\":\"
category = Custom
pulldown_type = true

let me know if this helps!

[karthi25]

@mayurr98 Is any other way like,Say when the user selects last 7 days then we need to get the starting date and ending date from it and use the both in where query like startDate between starting date and ending date

[niketn]

@karthi25, what @mayur98 has suggested is the better way. Since Splunk reads time series data, having incorrect time field in the raw events will only lead to performance and data interpretation issues. So it is better to fix time while indexing and also correct already indexed data with incorrect timestamp.

One of the options would be to convert StartDate to epoch time using strptime() and create your own dropdown for filtering. However, there will be performance issue with this approach as you will have to extract more data from your index in the base search and filter afterwards.