How to use a dashboard time range picker to reference a time column in a CSV file generated by an inputcsv search?

[ishaanshekhar]

I have a csv file that I have not indexed and am using it directly through the inputcsv command. The problem is that since it is not indexed, it does not have a _time value by default. I want the dashboard to have a time range picker that would reference a column in the csv file as the _time.

I tried this search below, but that says no results found.

| inputcsv file.csv | eval _time=strptime(Ticket_Reported_Date,"%Y/%m/%d %H:%M:%S") | search earliest=$time_tok.earliest$ latest=$time_tok.latest$ | timechart span=1mon count

Please help!!! Thanks in advance!

[cspires64]

This also works . . .
|inputlookup Example.csv | addinfo |eval et=round(info_min_time, 0) | eval lt=if(info_max_time='+Infinity', 'now', round(info_max_time, 0)) | convert timeformat="%Y/%m/%d %H:%M:%S" ctime(et), ctime(lt)| where DateField>=et AND DateField

[martin_mueller · Accepted solution]

Replace your search with this:

... | where _time >="$time_tok.earliest$" AND _time < if("$time_tok.latest$"=="now", now(), "$time_tok.latest$") | ...

Make sure all the special cases such as all time are handled properly, add similar if() expressions if they aren't.

[ishaanshekhar]

Thank you Martin! The search did indeed work... and as you said, would require all the special cases of time format. Is there a list that I could refer to include in my conditions... I guess relative dates could be anything so it may be difficult to maintain huge list of conditions.

Is it possible to use the time range picker as is, and directly use the token value without multiple conditions check?

If it is not possible, then I would try changing the time range view to include only fixed date range option and disable the rest.

Thank you!

[martin_mueller]

I'd approach this with a small case() - one branch deals with "now", another with numbers for epoch timestamps, and another uses relative_time(now(), ) to deal with "-5m" and the like.