Match jobs

[taha13]

So my question is:

I have jobs for each month (job for January, job for February ...), in my dashboard I have a filter on the period (month and year), for the month I is how to do it (I makes the call to the job corresponds to the month), but for the year , there is my problem, I do not know how I can display all the data (match those of January + February + March)

NB: I can't do a job on the year because of the large size of the data

[somesoni2]

What the search you're using right now? What the timerange you use for Month?

[taha13]

This is what i'm using for each month ,for march (job name : job_mois_encours),and for february (job name :job_mois_fevrier_2018)

    <condition label="Mois en cours">
          <set token="earliest1_token">true</set>
          <set token="earliest_token">$value$</set>
          <set token="latest_token">true</set>
          <set token="time_token">true</set>
          <unset token="depends_token_1">true</unset>
          <unset token="depends_token_2">true</unset>
          <set token="depends_token_3">true</set>
          <unset token="depends_token_4">true</unset>
          <unset token="depends_token_5">true</unset>
          <unset token="depends_token_6">true</unset>
          <unset token="depends_token_7">true</unset>
          <unset token="depends_token_8">true</unset>
          <unset token="depends_token_9">true</unset>
          <set token="show_Data_Labels_token">all</set>
          <set token="token_span">$token_span3$</set>
          <!-- <set token="loadjob_token_job">job_mois_encours</set> -->
          <set token="loadjob_token_job">job_mois_encours</set>
        </condition>
        <condition label="Mois précédent">
          <set token="earliest1_token">$value$</set>
          <set token="earliest_token">true</set>
          <set token="latest_token">-0mon@mon</set>
          <set token="time_token">true</set>
          <unset token="depends_token_1">true</unset>
          <unset token="depends_token_2">true</unset>
          <unset token="depends_token_3">true</unset>
          <unset token="depends_token_4">true</unset>
          <unset token="depends_token_5">true</unset>
          <unset token="depends_token_6">true</unset>
          <unset token="depends_token_7">true</unset>
          <set token="depends_token_8">true</set>
          <unset token="depends_token_9">true</unset>
          <set token="show_Data_Labels_token">all</set>
          <set token="token_span">$token_span8$</set>
          <set token="loadjob_token_job">job_mois_fevrier_2018</set>
        </condition>

For this year ,this is the timerange that i use

 <condition label="Année en cours">
          <set token="earliest1_token">true</set>
          <set token="earliest_token">$value$</set>
          <set token="latest_token">true</set>
          <set token="time_token">true</set>
          <unset token="depends_token">true</unset>
          <unset token="depends_token_1">true</unset>
          <unset token="depends_token_2">true</unset>
          <unset token="depends_token_3">true</unset>
          <set token="depends_token_4">true</set>
          <unset token="depends_token_5">true</unset>
          <unset token="depends_token_6">true</unset>
          <unset token="depends_token_7">true</unset>
          <unset token="depends_token_8">true</unset>
          <unset token="depends_token_9">true</unset>
          <set token="show_Data_Labels_token">all</set>
          <set token="token_span">$token_span4$</set>
        </condition>

And then n each panel,when i load the joabs ,i have

  |loadjob savedsearch="a468413:ied:$loadjob_token_job$"
           |eval date_time = strftime(_time,"%Y-%m-%d") 
              | eval earliest_time_relative=relative_time(now(),"$earliest_token$")
                | eval earliest_time = strftime(earliest_time_relative,"%Y-%m-%d")

                | eval earliest1_time_relative=relative_time(now(),"$earliest1_token$")
                | eval earliest1_time = strftime(earliest1_time_relative,"%Y-%m-%d")

                | eval latest_time_relative=relative_time(now(),"$latest_token$")
                | eval latest_time = strftime(latest_time_relative,"%Y-%m-%d")

                | eval date = strftime(_time,"%Y-%m-%d")
                | where date == "$time_token$" OR (date_time >= earliest1_time AND latest_time >= date_time) OR date_time>= earliest_time