Getting Data In

How to create a dropdown with custom time range?

karthi25
Path Finder

I am having the field StartDate in the splunk log, My search should based on the startDate field instead of event date.
For example,
I have the even date as "31-01-2018 09:23:23" and the data as below:

{"StartDate":"2018-01-31 03:30:14.0",splunkId=123, processLogId=12, processName='abc'}
{"StartDate":"2018-01-31 03:25:14.0",splunkId=345, processLogId=12, processName='abc'}
{"StartDate":"2018-01-30 01:30:14.0",splunkId=456, processLogId=12, processName='abc'}
{"StartDate":"2018-01-29 01:30:14.0",splunkId=678, processLogId=12, processName='abc'}
{"StartDate":"2017-12-31 03:30:14.0",splunkId=12123, processLogId=12, processName='abc'}
{"StartDate":"2017-12-31 03:25:14.0",splunkId=12345, processLogId=12, processName='abc'}
{"StartDate":"2017-12-30 01:30:14.0",splunkId=12456, processLogId=12, processName='abc'}
{"StartDate":"2017-12-29 01:30:14.0",splunkId=12678, processLogId=12, processName='abc'}

Now if I select last 7 days in the dropdown the search should be based on startDate , then it would returns as follows:

{"StartDate":"2018-01-31 03:30:14.0",splunkId=123, processLogId=12, processName='abc'}
{"StartDate":"2018-01-31 03:25:14.0",splunkId=345, processLogId=12, processName='abc'}
{"StartDate":"2018-01-30 01:30:14.0",splunkId=456, processLogId=12, processName='abc'}
{"StartDate":"2018-01-29 01:30:14.0",splunkId=678, processLogId=12, processName='abc'}

Can anyone please help me to do it.

0 Karma

mayurr98
Super Champion

have you set Splunk timestamp to be start date while indexing?

If NOT then you have to make your Splunk timestamp to take startdate, for that you can make below configurations in props.conf

[<your_sourcetype>]
DATETIME_CONFIG =
MAX_TIMESTAMP_LOOKAHEAD = 30
NO_BINARY_CHECK = true
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%N
TIME_PREFIX = StartDate\":\"
category = Custom
pulldown_type = true

let me know if this helps!

karthi25
Path Finder

@mayurr98 Is any other way like,Say when the user selects last 7 days then we need to get the starting date and ending date from it and use the both in where query like startDate between starting date and ending date

0 Karma

niketn
Legend

@karthi25, what @mayur98 has suggested is the better way. Since Splunk reads time series data, having incorrect time field in the raw events will only lead to performance and data interpretation issues. So it is better to fix time while indexing and also correct already indexed data with incorrect timestamp.

One of the options would be to convert StartDate to epoch time using strptime() and create your own dropdown for filtering. However, there will be performance issue with this approach as you will have to extract more data from your index in the base search and filter afterwards.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...