I have an index that contains multiple date/time fields. In my search I need to filter items by _time and an addition 1 or 2 timestamps.
My problem is I don't see an obvious way to reference the date range selected by the user for the report, such that I can specify something like the following:
| where completed_timestamp >= (start date/time selected by user) AND completed_timestamp <= (end date/time selected by user)
Is this possible to do?
You pull them in with addinfo
like this:
... | addinfo | where completed_timestamp >= info_min_time AND completed_timestamp <= info_max_time
This is often necessary when using DBConnect
but in that case, you usually need to embed it in a subsearch to force the detail into the SQL string.
You pull them in with addinfo
like this:
... | addinfo | where completed_timestamp >= info_min_time AND completed_timestamp <= info_max_time
This is often necessary when using DBConnect
but in that case, you usually need to embed it in a subsearch to force the detail into the SQL string.
This did exactly what I wanted.
I'd do the search in a dashboard with a time picker. Then you can reference the time picker earliest
and latest
values as tokens in your panel's search. See:
http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/TokenReference