All Apps and Add-ons

Splunk DB Connect 1: Why am I not getting correct results when selecting a time filter on "date" using the time range picker?

kavyaa
Explorer

Hi,

I have 2011 mar to 2015 mar data. I have applied time input filter on Transdate column in my database. In the time input filter, I have selected date range between 2011-03-21 to 2011-03-23. However, I am getting all data for 2011 to 2015. I am not getting correct results regarding selected value (2011-03-21 to 2011-03-23). Please help me. Thanks in advance. The code is as below. Please check it once.


<form>
  <label>Fetch date based</label>
  <fieldset submitButton="False" autoRun="true">
    <input type="time" searchWhenChanged="true" token="tok1">
      <label></label>
      <default>
        <earliest>1300645800</earliest>
        <latest>1300905000</latest>
      </default>
    </input>
    <input type="dropdown" token="tok1" id="field2">
      <selectFirstChoice>true</selectFirstChoice>
      <populatingSearch fieldForValue="TransDate" fieldForLabel="title">
        <![CDATA[
 | gentimes start=-1 | addinfo | eval title="between '".strftime(TransDate,"%d")."' and '".strftime(TransDate,"%dT")."'"]]>
      </populatingSearch>
    </input>
    <html id="field3">
 <style>
 .input#field2
 {
 display:none;
 }
 </style>      
     </html>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Showing report to period $title$</title>
        <search>
          <query>| dbquery "CENTRO" "SELECT  ShowRoomCode as srcode , TransDate as '_time' , Num_of_Customers as totalcs FROM  Centro_Customer_Visit "</query>
          <earliest>$tok1.earliest$</earliest>
          <latest>$tok1.latest$</latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

**
alt text

0 Karma

srisahitya_v
Communicator
  1. check the retention period on data. whether it was deleted 2011 data?
  2. if you are getting "splunk deamon error: timed out" then increase "splundconnectiontimeout" and try again.
0 Karma

kavyaa
Explorer

I have checked. I have 2011 mar to 2015 mar data. What ever i selected value 2011or 2012 or 2013 , it showing all 5years data

0 Karma

srisahitya_v
Communicator

let us know, as per your retention period this particular day bucket in which form?
1. hot
2. worm
3. cold
4. frozen
5. thawed

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...