I built a dashboard and am trying to include a time filter on Purchase Date and not the default _time field. At first I tried removing the _time field and renaming PurDate as _time but that did not work.
Then I added the following bit of code and I was able to filter results in search but it does not work in the dashboard.
Why won't my dashboard update when I change the time filter but does change in search?
| search
[| makeresults
| addinfo
| eval info_max_time=if(info_max_time=="+Infinity", now(), info_max_time)
| eval foo="PurDate>=".info_min_time." AND PurDate<".info_max_time
| table foo
| rename foo as search]
Here is the source code for one of the pannels
`
<panel>
<title>License Status</title>
<chart>
<search>
<query>| from inputlookup:"customer.csv"
| where (Region="NW") AND (IsActive="True")
| eval productName=split("Train##Car##Truck##Bike##Scooter","##")
| mvexpand productName
| lookup Purchases.csv customerID productName OUTPUT PurDate
| eval PurDate=strptime(FirstPurDate,"%Y-%m-%d")
| search
[| makeresults
| addinfo
| eval info_max_time=if(info_max_time=="+Infinity", now(), info_max_time)
| eval foo="FirstPurDate>=".info_min_time." AND PurDate<".info_max_time
| table foo
| rename foo as search]`
1) As @poete suggested, you need to use >
and <
in the panel code for >
and <
.
2) Do not assign a value to info_max_time
- that field is set at the search level. Use another variable name.
3) Make sure that your underlying variables (FirstPurDate) are stored in epoch format.
Hello @cromm,
I think you should try using <
and >
instead if <
and >
in your panel code.
Can you please try this?
What was the time range used when you ran this in search page?
I tried a few different options like date ranges (ex. 05/01/2018 through today) and presets (ex. current fiscal year). they all worked in the search but the dashboard would not change from what I last did in the search