Getting Data In

How to filter the event by different date than mapped in the sourcetype?

ninadbhaskarwar
Path Finder

We have Date1 mapped in the sourcetype for the index. So if I select last 7 days in the date filter data is filtered on date 1.
But for my project, I need to use Date2 as a date/duration filter in the dashboard. I cannot change the sourcetype only for my dashboards. Is there any way to make this changes in the settings or code?

Sample data
Created_Date (Date1)    First Name  Last Name   Task                    Execution_Date (Date2)
1/12/2017                   ABCD            XYZ                 Open Request    12/12/2017
6/12/2017                   DDFFG           SSV BBB          Save the File          12/12/2017

Data has been indexed on Created_Date (Date1) whereas I want to use Execution_Date (Date2) as a date filter.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi ninadbhaskarwar,

you can use eval and strptime() to use your Execution_Date field as _time. Here is just an example:

... | eval _time = strptime(Execution_Date, "%d/%m/%Y") | ...

Read more about strptime here http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/DateandTimeFunctions#strptime.28X....

Hope this helps ...

cheers, MuS

0 Karma

ninadbhaskarwar
Path Finder

Thanks, With this _time converted from Execution_Date but when I filter for last 7 days it doesn't use this _time

Regards
Ninad

0 Karma

MuS
SplunkTrust
SplunkTrust

Once the eval works as expected, create a calculated field http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields out of it and it will work using the time range picker 😉

cheers, MuS

0 Karma

horsefez
SplunkTrust
SplunkTrust

Hi @ninadbhaskarwar,

you need to describe your problem way more specific. Nobody will get what you are talking about or where you need help by reading what you did write up there.

Give us sample data if possible and please take your time to describe your problem properly, then we are glad to help you out. 🙂

0 Karma

ninadbhaskarwar
Path Finder

I have updated my question with sample data. hope this will give more sense of my question.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...