Getting Data In

How to use a dashboard time range picker to reference a time column in a CSV file generated by an inputcsv search?

Laya123
Communicator

Hi,

I have a csv file that I have not indexed and am using it directly through the inputcsv command. The problem is that since it is not indexed, it does not have a _time value by default. I want the dashboard to have a time range picker that would reference a column in the csv file as the _time.

I tried this search below and it's giving results, but giving results only if I will use Date&Time Range. If I will use last 15 minutes or previous month or any presets, it is not giving any error, but it's giving same values for any preset. Actually, my csv file has October month data. If I select last 15 minutes, I'm supposed to get 'No results', but it is giving complete October month values.

Search:

|inputlookup _AADaily.csv | where _time >="$time_tok.earliest$" AND _time < if("$time_tok.latest$"=="now", now(), "$time_tok.latest$")  |chart avg(Total_TimeSec) AS "Avg_Total_Time" over ServerName by Atype

Can any one help me to do this?

Thanks in advance

jmallorquin
Builder

From i know its not possible becouse the timepicker has differents values depending of the option that you choose. Sometimes is a epoch or simetimes is a value like @d ...

Hope help you

0 Karma

Laya123
Communicator

Hi,

Thank you so much for your immediate response.

If it is not possible, is there any way to limit the options in time picker means is it possible to remove other option and having only Date&Time Range. I want in timepicker drop only date &time range

Thanks

0 Karma

Laya123
Communicator

Hi,

It is possible and I got the solution for this. convert timeformat to the format which we have in CSV.

|inputlookup aaa.csv | addinfo |eval et=round(info_min_time, 0) | eval lt=if(info_max_time='+Infinity', 'now', round(info_max_time, 0)) | convert timeformat="%m/%d/%Y %H:%M:%S" ctime(et), ctime(lt)|------

Thank you

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...