The actual search should probably look something like this for tickets closed in the last week (my syntax is for Oracle): | dbquery "dbname" "select to_char(DateClosed,'YYYY-MM-DD HH24:MI:SS') DateClosed, TicketID from TableA where DateClosed>trunc(sysdate-7) group by DateClosed" | timechart span=1d sum(TicketID) by DateClosed This will allow you to timechart the number of tickets closed by any span size you want. ... View more

You don't actually need two different time pickers to do this. One will allow you to select any slice of time imaginable. Basically, you would just edit the dashboard, add a time picker, then for each element in the dashboard ensure that the time used for the search will be the time chosen with the picker instead of the existing time selection for the search. Here's the doc link: http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/FormEditor#Add_a_time_input_to_a_form . Hope that helps. ... View more

This should be updated in props.conf file only and under the stanza with actual sourcetype name (value using which you can select data in search, e.g. index=_internal sourcetype=splunkd). Also, you would need to restart/Refresh Splunk instance, Or add the calculated field using Splunk Web UI (Manager » Fields » Calculated fields) ... View more

I would like it if someone could tell me which ".conf" file I could put an eval stanza in to do the same thing so I don't have to do this on every single search line for all the date fields I want to convert... Is the props.conf file the right place to eval the date to something readable or is that only for changing it before it gets indexed? Thanks ... View more

Could you please try below rex. "(?i)^(?:[^,]*,){7}(?P [^,]+)" ... View more

Excellent. If that worked for you, consider clicking the checkmark next to the response, so that others can know that it's a working solution. Happy Splunking! ... View more

I did that, but it won't scale. I want to delete the data. Permanently. Irretrievably. To a point of metaphysical nonbeing. Yesterday's data does not matter. It's archived elsewhere. The CLEAN command seems to be locked away in a newbie-proof bottle. ... View more