Hi All,
Thanks in advance.
By default time range picker is using _time. I want to change the value of time range picker value from _time to reported_date.
So, please help me out.
It can be done but it is nasty. You must expand the timepicked range a bit ( myBufferSeconds
) to make sure that you capture the all the events with the other time values because obviously the other time field ( MyOtherEpochDateField
) has different values than _time
does (or you wouldn't be asking this).
index=YouShouldAlwaysSpecifyAnIndex sourcetype=AndSourcetypeToo
[| makeresults
| addinfo
| eval myBufferSeconds = 5*24*60*60
| eval search="earliest=" . round((info_min_time - myBufferSeconds),0) . " latest=" . round((info_max_time + myBufferSeconds), 0)
| table search]
MyOtherEpochDateField>=
[| makeresults
| addinfo
| return $info_min_time] AND
MyOtherEpochDateField<=
[| makeresults
| addinfo
| return $info_max_time]
If your MyOtherEpochDateField
is not a time_t
(AKA epoch
) then you have to do even more work and you can no longer template your base search and have to pull all the events in and use a | eval MyOtherEpochDateField=strptime(MyOtherEpochDateField, "%some%time%format%here") | search MyOtherEpochDateField ....
@vivek_manoj, this can be done but will have performance impact on your dashboard/s. You should consider event timestamp to pick _time from reported_date during data ingestion if you want to build dashboard/s on reported_date.
Can you add some sample events with examples of reported_date? Also what is the field/value behind extraction of event timestamp (_time)?