How to use a dashboard time range picker to reference a time column in a CSV file generated by an inputcsv search?

[Laya123]

Hi,

I have a csv file that I have not indexed and am using it directly through the inputcsv command. The problem is that since it is not indexed, it does not have a _time value by default. I want the dashboard to have a time range picker that would reference a column in the csv file as the _time.

I tried this search below and it's giving results, but giving results only if I will use Date&Time Range. If I will use last 15 minutes or previous month or any presets, it is not giving any error, but it's giving same values for any preset. Actually, my csv file has October month data. If I select last 15 minutes, I'm supposed to get 'No results', but it is giving complete October month values.

Search:

|inputlookup _AADaily.csv | where _time >="$time_tok.earliest$" AND _time < if("$time_tok.latest$"=="now", now(), "$time_tok.latest$")  |chart avg(Total_TimeSec) AS "Avg_Total_Time" over ServerName by Atype

Can any one help me to do this?

Thanks in advance

[jmallorquin]

From i know its not possible becouse the timepicker has differents values depending of the option that you choose. Sometimes is a epoch or simetimes is a value like @d ...

Hope help you

[Laya123]

Hi,

Thank you so much for your immediate response.

If it is not possible, is there any way to limit the options in time picker means is it possible to remove other option and having only Date&Time Range. I want in timepicker drop only date &time range

Thanks

[Laya123]

Hi,

It is possible and I got the solution for this. convert timeformat to the format which we have in CSV.

|inputlookup aaa.csv | addinfo |eval et=round(info_min_time, 0) | eval lt=if(info_max_time='+Infinity', 'now', round(info_max_time, 0)) | convert timeformat="%m/%d/%Y %H:%M:%S" ctime(et), ctime(lt)|------

Thank you