Dashboards & Visualizations

filter a field based on a time picker (handling of special now / all time cases)

sylbaea
Communicator

Hello,

I have a query where I need to filter a date DateOpen_EPOC (already in EPOC format) with a time picker (token is date_open). This time picker is not linked to default _time.

From a past question on the forum, I got this which works fine in most of the case:

(...)
| where DateOpen_EPOC >= if(replace("$date_open.earliest$","\d","")!="",relative_time(now(),"$date_open.earliest$"),"$date_open.earliest$")  
AND  DateOpen_EPOC >= if(replace("$date_open.latest$","\d","")!="",relative_time(now(),"$date_open.latest$"),"$date_open.latest$")  
(...)

However this query does not work in (at least) in two specific cases:
- Time Picker = "All time" --> in that case, it looks $date_open.earliest$ and $date_open.latest$ return nothing and it does not work
- Time Picker = "Last 7 days" (for instance). Here $date_open.latest$ equals now and it does not work

Any suggestion to improve (or replace) this query to truly manage all cases ?
Thanks.

0 Karma

woodcock
Esteemed Legend

Like this (NOTE: one of your > should surely have been <😞

(...)
| addinfo | where DateOpen_EPOC>=info_min_time AND DateOpen_EPOC<=info_max_time
(...)
0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...