Populating drop down with values generated from a search

[mahbs]

Hi Guys,

I've searched this question on splunk, however, the examples shown are a bit too complex for me to grasp, hence I'm asking here.
I have a search which returns lots of dates. Now what I want is two drop down fields:

Start Date: End Date:

These dropdown fields need to be populatd with the dates that are being returned from my search.

How would I go about going that?

Kind Regards
Mahbs

[niketn]

@mahbs, For us to assist you better, can you add samples of what your Start Date and End Date look like in your Indexed Events? Also what are their field names.

[mahbs]

hey, absolutely, time stamp is in this format: 2017-10-18 00:00:00

With regards to the time, I'm currently returning the dates through the following query:

index="XXX" sourcetype="XXX" earliest=-1d@d latest=-0d@d | eval ReportKey="Yesterday" | append [search index="XXX" sourcetype="XXX" earliest= -7d@d latest=now | eval ReportKey="Last Week"] | timechart span= avg("XXX") by ReportKey

This query returned to me the dates during a specific time period, only trouble is, I'm not sure where the date variable is to store the dates

[gcusello]

Hi mahbs,
if you're meaning a time period for timestamps you have only to use a Time Input.

if Start_Date and Date are two fields of your sourcetype you can populate two inputs with a simple search

| my_search
| bin Start_Date span=1d
| eval Start_Date=strftime(Start_Date,"%d/%m/%Y")
| dedup Start_Date
| table Start_Date

.

| my_search
| bin End_Date span=1d
| eval End_Date =strftime(End_Date ,"%d/%m/%Y")
| dedup End_Date 
| table End_Date 

so in your searches you can add as token

my_search Start_Date="$Start_Date$" End_Date="$End_Date$"
| ...

Bye.
Giuseppe

[mahbs]

Hey Guiseppe,

Not quite, what i want to do is populate my start date and ed date with all the dates that are returned from the search query. I dont have ay fields in my table labelled "start date" and "end date". What I want the user to be able to do is select a start date and an end date, and the graph should update to show data during that time period.

This is what I have at the moment:

  <label>Start Date</label>
  <search fieldForLabel="Dates" fieldForValue="s_d" index="test" sourcetype="csv">
</input>

I need to figure out a way of assigning the token to all the dates in my query.

[gcusello]

You can find the earliest and latest date using stats command, so you can populate your dropdown:

your_search
| stats earliest(_time) AS earliest latest(_time) AS latest

Bye.
Giuseppe

[mahbs]

Hey Giuseppe,

I think for this particular task, I would want all the dates to be populated. Just to give users that freedom to choose a date. How would I do that?

[gcusello]

try

my_search
| bin _time span=1d
| eval Start_Date =strftime(_time ,"%d/%m/%Y")
| dedup Start_Date  
| table Start_Date 

Remeber, when you use tokens, to convert Start_Date and End_Date in epochtime, in othe words:
my_search earliest=strptime($Start_Date$,"%d/%m/%Y") latest=strptime($End_Date$,"%d/%m/%Y")

I was thinking to your question: why you don't use Time Picker?

Bye.
Giuseppe

[mahbs]

Hi Guissepe,

For the purpose of the task, drop down seems to be the best option. I found an example of someone trying to achieve the same thing as me, but the bit im getting confused on is the index bit:

index=main sourcetype=mainperfomance ChannelCode=* | head 1000 | stats count by ChannelCode | fields - count

Im basically trying to do the same thing, but i want to return all the dates

[gcusello]

Hi mahbs,
I used this solution when I didn't have continuous event flow but only events in a few days and using time picker it was possible to select an empty period.
If you have continuous events it's better (and easier) to use Time Picker.
If you want to help your users, you can set some predefined time intervals (e.g. last 2 days, last 3 days).
Bye.
Giuseppe