Need to select data based on the time range. Currently it populates data for All times, instead need to have it weekly, monthly, all time.
I've added a panel to Select Time Range but still it populates the data for "All Time". What changes are needed. I've attached by query below:
Summary
<input type="time" token="time_tok" searchWhenChanged="true">
<label>Select Time Range</label>
<default>
<earliestTime>-7d@h</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
<panel>
<table>
<title>ESD Summary</title>
<searchString>|inputlookup currentesdorders.csv | dedup ORDER_NUMBER | fields ESD_ORDER CREATION_DATE ORDER_TOTAL ITEM_DESCRIPTION | eval ESD_ORDER=if(ESD_ORDER="Y","ESD","Physical") | eval ZERO_DOLLAR_ORDER=if(ORDER_TOTAL =0,1,0) | eval NON_ZERO_ORDER=if(ORDER_TOTAL =0,0,1) | eval _time=CREATION_DATE | eval WORKS_7=if(like(ITEM_DESCRIPTION,"%Works 7%"),1,0) | stats count(_time) as "Order Count" sum(NON_ZERO_ORDER) as "$ Orders" sum(ZERO_DOLLAR_ORDER) as "Zero Dollar Orders" sum(WORKS_7) as "Works 7 Orders" by ESD_ORDER | addcoltotals labelfield=ESD_ORDER label="Order Total"</searchString>
<earliestTime>$time_tok.earliest$</earliestTime>
<latestTime>$time_tok.latest$</latestTime>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
Hi webnair
I think that your syntax is correct .
I advise you to put panel mark in row mark and verify well your query
if you use splunk 6.2.x
replace
<earliestTime></earliestTime>
by
<earliest></earliest> do the same with latestTime
and
replace
<SearchTime></SearchTime>
by
<Search><query></query></Search>
You have a syntax problem. the tags are "earliest" and "latest" - there is no such thing as earliestTime or latestTime etc, if you are referring to the Splunk time settings. so:
This would be your Timepicker:
<form>
<label>answers</label>
<fieldset submitButton="false">
<input type="time" token="time_tok" searchWhenChanged="true">
<label>Select Time Range</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
</form>
Same with the table
panel, you must fix those tags or there is no meaning...