Splunk Dev

dropdown

dall
Path Finder

i have one dropdown with month and year how can i separate and make 2 dropdown , one for month another one for year

 

my query is this

| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*"

| eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%Y %b")
| dedup new_date
| table new_date PUBLISHED_DATETIME
| sort - new_date

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This doesn't sound like the full story!

However, why not create your first dropdown with this query

| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*"

| eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%Y")
| dedup new_date
| fields new_date
| sort - new_date

and your second dropdown with this query

| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*"

| eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%b")
| dedup new_date
| fields new_date
| sort - new_date

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

This doesn't sound like the full story!

However, why not create your first dropdown with this query

| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*"

| eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%Y")
| dedup new_date
| fields new_date
| sort - new_date

and your second dropdown with this query

| inputlookup ... | search TITLE = "*Microsoft*" OR TITLE = "*Windows*"

| eval new_date=strftime(strptime(PUBLISHED_DATETIME,"%Y-%m-%d"),"%b")
| dedup new_date
| fields new_date
| sort - new_date
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...