Dashboards & Visualizations

text box input for date

frankagustinus
Explorer

I have a simple form that shows storage performance on a particular date using TimePicker.

But TimpePicker is not practical for my report form. I want a simple text box which I can simply key in "05/25/2014", click search, and my chart shows the storage performance on that date.

Is there a way to get that "05/25/2014" and put it into my search string ? Maybe some text-to-date conversion needed ? Or perhaps we put it not in search string but in the chart's parameter instead ?

Here is my current xml using TimePicker

<?xml version='1.0' encoding='utf-8'?>

<label>Storage Performance Report</label>

<fieldset>            
    <input type="time"></input>
</fieldset>

<searchTemplate>
    sourcetype="iostat" | multikv | search "c5t600A0B80006E23DE000003A74C3EA04Cd0" | timechart span=10m avg(usage)
</searchTemplate>

<row>   
    <chart>
        <title>Data File IOPS READ Detail</title>
        <option name="charting.chart">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.layout.splitSeries">false</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.primaryAxisTitle.text"/>
        <option name="charting.secondaryAxisTitle.text">READ IOPS</option>
    </chart>     
</row>

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

<form>    
<label>Storage Performance Report</label>    
<fieldset>            
   <input type="text" token="varDate">
    <label>Enter Date(format %m/%d/%Y)</label>
    <default></default>
   </input>
</fieldset>

<searchTemplate>
sourcetype="iostat" [| stats count | eval date=if("$varDate$"="",strftime(now(),"%m/%d/%Y"),"$varDate$") 
  | eval earliest=strptime(date." 00:00","%m/%d/%Y %H:%M")  | eval latest=relative_time(earliest,"+1d")
  | table earliest, latest  | format "" "" "" "" "" ""]  | multikv | search "c5t600A0B80006E23DE000003A74C3EA04Cd0" | timechart span=10m avg(usage)
</searchTemplate>

<row>   
    <chart>
        <title>Data File IOPS READ Detail</title>
        <option name="charting.chart">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.layout.splitSeries">false</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.primaryAxisTitle.text"/>
        <option name="charting.secondaryAxisTitle.text">READ IOPS</option>
    </chart>     
</row>    

0 Karma

Chandras11
Communicator

Hi @somesoni2... This answer helped me with my code as well. However, I am wondering if we can have today's date in as well. I read somewhere about the to write the command but it's not working at my end.

Sorry for commenting on 4 years old post.

0 Karma

niketn
Legend

@Chandras11, refer to one of my recent answers to use HTML Date input with jQuery to allow search query to pick selected from the Date input: https://answers.splunk.com/answers/627432/jquery-datepicker-in-splunk.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Chandras11
Communicator

Thanks for it 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...