Getting Data In

Match jobs

Explorer

So my question is:

I have jobs for each month (job for January, job for February ...), in my dashboard I have a filter on the period (month and year), for the month I is how to do it (I makes the call to the job corresponds to the month), but for the year , there is my problem, I do not know how I can display all the data (match those of January + February + March)

NB: I can't do a job on the year because of the large size of the data

Tags (2)
0 Karma

Revered Legend

What the search you're using right now? What the timerange you use for Month?

0 Karma

Explorer

This is what i'm using for each month ,for march (job name : job_mois_encours),and for february (job name :job_mois_fevrier_2018)

    <condition label="Mois en cours">
          <set token="earliest1_token">true</set>
          <set token="earliest_token">$value$</set>
          <set token="latest_token">true</set>
          <set token="time_token">true</set>
          <unset token="depends_token_1">true</unset>
          <unset token="depends_token_2">true</unset>
          <set token="depends_token_3">true</set>
          <unset token="depends_token_4">true</unset>
          <unset token="depends_token_5">true</unset>
          <unset token="depends_token_6">true</unset>
          <unset token="depends_token_7">true</unset>
          <unset token="depends_token_8">true</unset>
          <unset token="depends_token_9">true</unset>
          <set token="show_Data_Labels_token">all</set>
          <set token="token_span">$token_span3$</set>
          <!-- <set token="loadjob_token_job">job_mois_encours</set> -->
          <set token="loadjob_token_job">job_mois_encours</set>
        </condition>
        <condition label="Mois précédent">
          <set token="earliest1_token">$value$</set>
          <set token="earliest_token">true</set>
          <set token="latest_token">-0mon@mon</set>
          <set token="time_token">true</set>
          <unset token="depends_token_1">true</unset>
          <unset token="depends_token_2">true</unset>
          <unset token="depends_token_3">true</unset>
          <unset token="depends_token_4">true</unset>
          <unset token="depends_token_5">true</unset>
          <unset token="depends_token_6">true</unset>
          <unset token="depends_token_7">true</unset>
          <set token="depends_token_8">true</set>
          <unset token="depends_token_9">true</unset>
          <set token="show_Data_Labels_token">all</set>
          <set token="token_span">$token_span8$</set>
          <set token="loadjob_token_job">job_mois_fevrier_2018</set>
        </condition>

For this year ,this is the timerange that i use

 <condition label="Année en cours">
          <set token="earliest1_token">true</set>
          <set token="earliest_token">$value$</set>
          <set token="latest_token">true</set>
          <set token="time_token">true</set>
          <unset token="depends_token">true</unset>
          <unset token="depends_token_1">true</unset>
          <unset token="depends_token_2">true</unset>
          <unset token="depends_token_3">true</unset>
          <set token="depends_token_4">true</set>
          <unset token="depends_token_5">true</unset>
          <unset token="depends_token_6">true</unset>
          <unset token="depends_token_7">true</unset>
          <unset token="depends_token_8">true</unset>
          <unset token="depends_token_9">true</unset>
          <set token="show_Data_Labels_token">all</set>
          <set token="token_span">$token_span4$</set>
        </condition>

And then n each panel,when i load the joabs ,i have

  |loadjob savedsearch="a468413:ied:$loadjob_token_job$"
           |eval date_time = strftime(_time,"%Y-%m-%d") 
              | eval earliest_time_relative=relative_time(now(),"$earliest_token$")
                | eval earliest_time = strftime(earliest_time_relative,"%Y-%m-%d")

                | eval earliest1_time_relative=relative_time(now(),"$earliest1_token$")
                | eval earliest1_time = strftime(earliest1_time_relative,"%Y-%m-%d")

                | eval latest_time_relative=relative_time(now(),"$latest_token$")
                | eval latest_time = strftime(latest_time_relative,"%Y-%m-%d")

                | eval date = strftime(_time,"%Y-%m-%d")
                | where date == "$time_token$" OR (date_time &gt;= earliest1_time AND latest_time &gt;= date_time) OR date_time&gt;= earliest_time
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!