Hi, it's just that I want to make a dashboard with a time
menu but when I run it show me always the same Dashboard independant of the time
how I choose, so I try to understand I wrote that:
| dbquery "MUSTER_BACKUP" "SELECT [submission_time],[submitter] FROM backup_db_jobs"
| eval mytime=strftime(submission_time,"%Y-%m-%d %H:%M:%S")
| eval s_time=strftime(_time,"%Y-%m-%d %H:%M:%S")
| eval _time=if(min(s_time) < mytime,s_time,mytime)
| eval pldetmpshumain=strftime(pldetmps,"%Y-%m-%d %H:%M:%S")
but when I start it (I try a lot of time with another notation) I see that the _time
is always the same as the submission_time
everyone know's what's going on ?
Here is a fun trick:
| dbquery "MUSTER_BACKUP" "SELECT [submission_time],[submitter] FROM backup_db_jobs"
| rename COMMENT AS "The Timepicker magic is here"
| addinfo
| where submission_time >= info_min_time AND submission_time <= info_max_time
| fieldformat mytime=strftime(submission_time,"%Y-%m-%d %H:%M:%S")
| fieldformat s_time=strftime(_time,"%Y-%m-%d %H:%M:%S")
| evenstats min(s_time) As min_s_time
| eval _time=if(min_s_time < mytime, s_time, mytime)
| eval pldetmpshumain=strftime(pldetmps,"%Y-%m-%d %H:%M:%S")
Here is a fun trick:
| dbquery "MUSTER_BACKUP" "SELECT [submission_time],[submitter] FROM backup_db_jobs"
| rename COMMENT AS "The Timepicker magic is here"
| addinfo
| where submission_time >= info_min_time AND submission_time <= info_max_time
| fieldformat mytime=strftime(submission_time,"%Y-%m-%d %H:%M:%S")
| fieldformat s_time=strftime(_time,"%Y-%m-%d %H:%M:%S")
| evenstats min(s_time) As min_s_time
| eval _time=if(min_s_time < mytime, s_time, mytime)
| eval pldetmpshumain=strftime(pldetmps,"%Y-%m-%d %H:%M:%S")
Thank you a lot !!