I built a dashboard and am trying to include a time filter on Purchase Date and not the default _time field. At first I tried removing the _time field and renaming PurDate as _time but that did not work.
Then I added the following bit of code and I was able to filter results in search but it does not work in the dashboard.
Why won't my dashboard update when I change the time filter but does change in search?
| eval info_max_time=if(info_max_time=="+Infinity", now(), info_max_time)
| eval foo="PurDate>=".info_min_time." AND PurDate<".info_max_time
| table foo
| rename foo as search]
Here is the source code for one of the pannels
<panel> <title>License Status</title> <chart> <search> <query>| from inputlookup:"customer.csv" | where (Region="NW") AND (IsActive="True") | eval productName=split("Train##Car##Truck##Bike##Scooter","##") | mvexpand productName | lookup Purchases.csv customerID productName OUTPUT PurDate | eval PurDate=strptime(FirstPurDate,"%Y-%m-%d") | search [| makeresults | addinfo | eval info_max_time=if(info_max_time=="+Infinity", now(), info_max_time) | eval foo="FirstPurDate>=".info_min_time." AND PurDate<".info_max_time | table foo | rename foo as search]`
1) As @poete suggested, you need to use
< in the panel code for
2) Do not assign a value to
info_max_time - that field is set at the search level. Use another variable name.
3) Make sure that your underlying variables (FirstPurDate) are stored in epoch format.
I tried a few different options like date ranges (ex. 05/01/2018 through today) and presets (ex. current fiscal year). they all worked in the search but the dashboard would not change from what I last did in the search