Dashboards & Visualizations

Custom time preset as specific date

wh_ols
New Member

Is it possible to set the custom time preset to be a specific date rather than a relative time?

i.e. I want to be able to quickly select to view any metrics on 01/01/2017:00:00:00 - 01/01/2017:23:59:59

0 Karma

gvmorley
Contributor

Hi,

Absolutely. You simply need to specifiy the earliest_time and latest_time as their epoch values.

So for your example, you could do something like this in your times.conf:

[my_custom_time]
label = January 1st 2017
earliest_time = 1483228800
latest_time = 1483315199

If you want to work out epoch times, there are many online tools which you could use.

Or, Splunk can always help you. Here's an example search, which you could change as required:

| makeresults
| fields - _time
| eval t1="01/01/2017:00:00:00", t2="01/01/2017:23:59:59"
| eval t1_epoch=strptime(t1,"%d/%m/%Y:%H:%M:%S"), t2_epoch=strptime(t2,"%d/%m/%Y:%H:%M:%S")

I hope this helps.

0 Karma

chuckers
Path Finder

Sure. just add this to your query

earliest=1/1/2017:0:0:0 latest=1/1/2017:23:59:59 yourSearchTerms | stats ...

Edit:

Sorry, upon a re-read I am guessing that you want to add that fixed time range to the Presets menu of the standard Splunk Time picker input.

I'm not sure how to do that but you could create a drop down of time options that contain the same Preset selections as the standard time picker.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...