Getting Data In

How to use a dashboard time range picker to reference a time column in a CSV file generated by an inputcsv search?

Laya123
Communicator

Hi,

I have a csv file that I have not indexed and am using it directly through the inputcsv command. The problem is that since it is not indexed, it does not have a _time value by default. I want the dashboard to have a time range picker that would reference a column in the csv file as the _time.

I tried this search below and it's giving results, but giving results only if I will use Date&Time Range. If I will use last 15 minutes or previous month or any presets, it is not giving any error, but it's giving same values for any preset. Actually, my csv file has October month data. If I select last 15 minutes, I'm supposed to get 'No results', but it is giving complete October month values.

Search:

|inputlookup _AADaily.csv | where _time >="$time_tok.earliest$" AND _time < if("$time_tok.latest$"=="now", now(), "$time_tok.latest$")  |chart avg(Total_TimeSec) AS "Avg_Total_Time" over ServerName by Atype

Can any one help me to do this?

Thanks in advance

jmallorquin
Builder

From i know its not possible becouse the timepicker has differents values depending of the option that you choose. Sometimes is a epoch or simetimes is a value like @d ...

Hope help you

0 Karma

Laya123
Communicator

Hi,

Thank you so much for your immediate response.

If it is not possible, is there any way to limit the options in time picker means is it possible to remove other option and having only Date&Time Range. I want in timepicker drop only date &time range

Thanks

0 Karma

Laya123
Communicator

Hi,

It is possible and I got the solution for this. convert timeformat to the format which we have in CSV.

|inputlookup aaa.csv | addinfo |eval et=round(info_min_time, 0) | eval lt=if(info_max_time='+Infinity', 'now', round(info_max_time, 0)) | convert timeformat="%m/%d/%Y %H:%M:%S" ctime(et), ctime(lt)|------

Thank you

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...