All Apps and Add-ons

Splunk DB Connect 1: Why am I not getting correct results when selecting a time filter on "date" using the time range picker?

kavyaa
Explorer

Hi,

I have 2011 mar to 2015 mar data. I have applied time input filter on Transdate column in my database. In the time input filter, I have selected date range between 2011-03-21 to 2011-03-23. However, I am getting all data for 2011 to 2015. I am not getting correct results regarding selected value (2011-03-21 to 2011-03-23). Please help me. Thanks in advance. The code is as below. Please check it once.


<form>
  <label>Fetch date based</label>
  <fieldset submitButton="False" autoRun="true">
    <input type="time" searchWhenChanged="true" token="tok1">
      <label></label>
      <default>
        <earliest>1300645800</earliest>
        <latest>1300905000</latest>
      </default>
    </input>
    <input type="dropdown" token="tok1" id="field2">
      <selectFirstChoice>true</selectFirstChoice>
      <populatingSearch fieldForValue="TransDate" fieldForLabel="title">
        <![CDATA[
 | gentimes start=-1 | addinfo | eval title="between '".strftime(TransDate,"%d")."' and '".strftime(TransDate,"%dT")."'"]]>
      </populatingSearch>
    </input>
    <html id="field3">
 <style>
 .input#field2
 {
 display:none;
 }
 </style>      
     </html>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Showing report to period $title$</title>
        <search>
          <query>| dbquery "CENTRO" "SELECT  ShowRoomCode as srcode , TransDate as '_time' , Num_of_Customers as totalcs FROM  Centro_Customer_Visit "</query>
          <earliest>$tok1.earliest$</earliest>
          <latest>$tok1.latest$</latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

**
alt text

0 Karma

srisahitya_v
Communicator
  1. check the retention period on data. whether it was deleted 2011 data?
  2. if you are getting "splunk deamon error: timed out" then increase "splundconnectiontimeout" and try again.
0 Karma

kavyaa
Explorer

I have checked. I have 2011 mar to 2015 mar data. What ever i selected value 2011or 2012 or 2013 , it showing all 5years data

0 Karma

srisahitya_v
Communicator

let us know, as per your retention period this particular day bucket in which form?
1. hot
2. worm
3. cold
4. frozen
5. thawed

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...