Getting Data In

How to filter the event by different date than mapped in the sourcetype?

Path Finder

We have Date1 mapped in the sourcetype for the index. So if I select last 7 days in the date filter data is filtered on date 1.
But for my project, I need to use Date2 as a date/duration filter in the dashboard. I cannot change the sourcetype only for my dashboards. Is there any way to make this changes in the settings or code?

Sample data
Created_Date (Date1)    First Name  Last Name   Task                    Execution_Date (Date2)
1/12/2017                   ABCD            XYZ                 Open Request    12/12/2017
6/12/2017                   DDFFG           SSV BBB          Save the File          12/12/2017

Data has been indexed on CreatedDate (Date1) whereas I want to use ExecutionDate (Date2) as a date filter.

0 Karma

SplunkTrust
SplunkTrust

Hi ninadbhaskarwar,

you can use eval and strptime() to use your Execution_Date field as _time. Here is just an example:

... | eval _time = strptime(Execution_Date, "%d/%m/%Y") | ...

Read more about strptime here http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/DateandTimeFunctions#strptime.28X....

Hope this helps ...

cheers, MuS

0 Karma

Path Finder

Thanks, With this time converted from ExecutionDate but when I filter for last 7 days it doesn't use this _time

Regards
Ninad

0 Karma

SplunkTrust
SplunkTrust

Once the eval works as expected, create a calculated field http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields out of it and it will work using the time range picker 😉

cheers, MuS

0 Karma

SplunkTrust
SplunkTrust

Hi @ninadbhaskarwar,

you need to describe your problem way more specific. Nobody will get what you are talking about or where you need help by reading what you did write up there.

Give us sample data if possible and please take your time to describe your problem properly, then we are glad to help you out. 🙂

0 Karma

Path Finder

I have updated my question with sample data. hope this will give more sense of my question.

0 Karma