Splunk Search

using different date range but showing the same value

ramkyreddy
Explorer

When I was searching  for the different data ranges in my Splunk dashboard it showed the same,
for example, i am selecting 1/1/2024 to 1/10/2024 and  1/3/2024 to 1/4/2024 and
i am adding this query earliest=-7d@d latest=+1d but when removed these values do not match

 Please help out with this

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Looks like your search may be wrong - please share the source of your dashboard in a code block

0 Karma

ramkyreddy
Explorer

selected the date from 1 jan 2024 to 2 jan 2024
----------------------------------------------------------------
index="bsds_gans" earliest=1704096000 latest=+1d pfor IN (*) test IN (*) name IN (*) ckb IN (*) vrsion IN (*) id IN (*) location IN (*) group IN (*)

| eval pfor=upper(pfor)
| eval _time = start_time
| eval WW=strftime(_time, "%V.%w")
| eval name=mvindex(split(context,"."),1)
| search name !="*Case Setup*"
| eval name=mvindex(split(name,".PSPV"),0)
| eval id=mvindex(split(name," - "),0)
| search id IN (*)
| eval main=mvindex(split(name," - "),1)
| search main IN (*)
| stats count(eval(sta="FIL")) as fail_count, count(eval(sta="PASS")) as pass_count, count(eval(like(sta,"LOCKED%"))) as not_run_count by name,id

--------------------------------------------------------------------
selected date is from 1jan 2024 to 13 jan 2024

index="bsds_gans" earliest=1704096000 latest=+1d pfor IN (*) test IN (*) name IN (*) ckb IN (*) vrsion IN (*) id IN (*) location IN (*) group IN (*)

| eval pfor=upper(pfor)
| eval _time = start_time
| eval WW=strftime(_time, "%V.%w")
| eval name=mvindex(split(context,"."),1)
| search name !="*Case Setup*"
| eval name=mvindex(split(name,".PSPV"),0)
| eval id=mvindex(split(name," - "),0)
| search id IN (*)
| eval main=mvindex(split(name," - "),1)
| search main IN (*)
| stats count(eval(sta="FIL")) as fail_count, count(eval(sta="PASS")) as pass_count, count(eval(like(sta,"LOCKED%"))) as not_run_count by name,id
-----------------------------------------------------------------------
selected  for last 7 days

index="bsds_gans" earliest=-7d@h latest=+1d pfor IN (*) test IN (*) name IN (*) ckb IN (*) version IN (*) id IN (*) location IN (*) group IN (*)

| eval pfor=upper(pfor)
| eval _time = start_time
| eval WW=strftime(_time, "%V.%w")
| eval name=mvindex(split(context,"."),1)
| search name !="*Case Setup*"
| eval name=mvindex(split(name,".PSPV"),0)
| eval id=mvindex(split(name," - "),0)
| search id IN (*)
| eval main=mvindex(split(name," - "),1)
| search main IN (*)
| stats count(eval(sta="FIL")) as fail_count, count(eval(sta="PASS")) as pass_count, count(eval(like(sta,"LOCKED%"))) as not_run_count by name,id

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The earliest and latest settings in the search are overriding the values chosen from the timepicker and since these are the same, the numbers in your panels are the same.

0 Karma

ramkyreddy
Explorer

The numbers in the panels are the same when trying different time ranges as I mentioned in the above search query

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what searches are giving what results - you mentioned 3 searches, but showed only two sets of panels. All the searches you have shown use earliest and latest settings which override anything you have chosen in the timepicker, so it is not clear which timeperiods have been used for which sets of panels. Please clarify

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...