Reporting

How do I reference the start and end date from the datetime picker?

mumblingsages
Path Finder

I have an index that contains multiple date/time fields. In my search I need to filter items by _time and an addition 1 or 2 timestamps.

My problem is I don't see an obvious way to reference the date range selected by the user for the report, such that I can specify something like the following:

| where completed_timestamp >= (start date/time selected by user) AND completed_timestamp <= (end date/time selected by user)

Is this possible to do?

0 Karma
1 Solution

woodcock
Esteemed Legend

You pull them in with addinfo like this:

... | addinfo | where completed_timestamp >= info_min_time AND completed_timestamp <= info_max_time

This is often necessary when using DBConnect but in that case, you usually need to embed it in a subsearch to force the detail into the SQL string.

View solution in original post

0 Karma

woodcock
Esteemed Legend

You pull them in with addinfo like this:

... | addinfo | where completed_timestamp >= info_min_time AND completed_timestamp <= info_max_time

This is often necessary when using DBConnect but in that case, you usually need to embed it in a subsearch to force the detail into the SQL string.

View solution in original post

0 Karma

mumblingsages
Path Finder

This did exactly what I wanted.

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

I'd do the search in a dashboard with a time picker. Then you can reference the time picker earliest and latest values as tokens in your panel's search. See:

http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/TokenReference

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.