Custom search by Date on results pulled from DB

[aboccia]

Hello Splunk Community,

I am very new to splunk and am currently having a small issue. I have a search query which pulls results from a database, the date field returns an epoch encoded date string which i use splunk to convert to human readable format, the results are shown below:

Query:
| dbquery "ActionDB - Connection 1" "SELECT action_type,activity_date FROM app_activity"|convert timeformat="%D" ctime(activity_date) | rename action_type AS Activity activity_date AS "Activity Date" |fields "Activity Date",Activity

Results:
Activity Date Activity
1 03/27/06 Run
2 03/27/06 Jump Rope
3 03/27/06 None
4 05/10/06 None
5 03/10/06 Eat Apple
6 04/11/06 Run

When i attempt to input a custom search time, it does not seem to work. I have been attempting to find a way to be able to search and return results based on a custom time span checked against the activity date field. I suspect I am having difficulty with this query because these are results gathered from a direct DB query, would I have to create a custom field for this search in order for the splunk system to recognize the date stamps? or is there a way to do this in the search by specifying which DB fields to use to check against the custom search time.

Any idea would be greatly appreciated,

Thank You

[sowings]

If you mean that you're using the time range picker (up in the upper right near the search button) to change the time span, at present, DB connect doesn't "play nice" with the time picker.

There are two approaches described in the answers post listed below.

http://answers.splunk.com/answers/75999/splunk-db-connect-dbquery-inline-search-and-time-filtering-n...

[aboccia]

Thank you very much for that link, I was able to create the macro and can now customize the search time by the DB date field.