I have below data
The Splunk time range is based on LOG_DATE
In the dashboard have the date filter, if select 20160809 it display the count as 3 instead of 6. The graph is plotted for span of 15 min for the selected date. Below is the code snippet. The root cause is it searching based on the selected date in the LOG_DATE and not in the MSG_RECV_DATE because the time range field is mapped to LOG_DATE
sourcetype=test | eval PaymentRecvDateTime= MSG_RECV_DATE.MSG_RECV_TIME | eval PaymentRecvDateTimeEpoch= strptime(PaymentRecvDateTime,"%Y%m%d%H%M%S")| bucket PaymentRecvDateTimeEpoch span=15m | stats dc(LOG_REF_ID) as PaymentCount by PaymentRecvDateTimeEpoch | search PaymentRecvDateTimeEpoch<=$ENDDATEEPOCH$ PaymentRecvDateTimeEpoch>=$STARTDATEEPOCH$ | rename PaymentRecvDateTimeEpoch AS _time |timechart span=15m sum(PaymentCount) as count
index=xyz MSG_RECV_DATE>=[| makeresults | eval search=strftime(relative_time(now() , "$timepicker.earliest$"), "%Y%m%d") | fields search] MSG_RECV_DATE<=[| makeresults | eval search=strftime(relative_time(now() , "$timepicker.latest$"), "%Y%m%d") | fields search] | rest of your search here
Or try this
index=xyz [| makeresults | eval l=strftime($ENDDATEEPOCH$, "%Y%m%d") | eval e=strftime($STARTDATEEPOCH$, "%Y%m%d") | eval search="(MSG_RECV_DATE>=".e." AND MSG_RECV_DATE<=".l.")" | table search ]
Are you wanting to have the time range picker on a dashboard (Add Input > Time) not to search on the Splunk "_time" value which is default of when the event was indexed. But that of the timestamp found within the event itself "_raw"?