I want to add "Month to date" time option along with other time options that I have specified for the dashboards. Below is my query for showing the Monthly stats, along with that one option I have to add is Month to date. Please let me know how can I do that ?
index=comm sourcetype=sub |table _time|eval Month=strftime(_time,"%B-%Y") |table Month|dedup Month
Attaching image for your reference. Along with months, I want to add "Month to date" Option. Please help to resolve this.
When the particular time option is selected, it show the panels for that time option. I am using $mon$ token to pass the value in the search query for the panels. So usually it passes the whole month and the panels are loading the stats for that month. But, I am not sure, on how to add "Month to date" using the same token in the same query ?
One of the panel search is below :
index=comm sourcetype=sub|table _time,organisations.*.on|untable _time organisations Users |eval Organisation=upper(mvindex(split(organisations,"."),1))|eval Month=strftime(_time,"%B-%Y")|search Month="$mon$"|sort - _time|dedup Organisation,Month
|sort -Users|fields - organisations|table Organisation,Users
|stats sum(Users) as Users
You are going about it wrong. Just put your dashboard in a Custom App
, and create a custom times.conf
file with custom settings matching what you need, and set the preferences
to App
in local.meta
so that these custom timepicker settings only apply to dashboards in that app:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Timesconf
This file already contains Month to date
options which show you how to create Previous Month to date
, etc. Then you can simply use the standard Time picker
in your dashboard with your custom times
settings.
I understand. But user wants only specific time picker inputs, not all that shows by default. They just want ready-made month-wise inputs :-), wherein they will select month and see the stats.
You are not hearing me. You can change the Time picker
to only have the settings that you'd like it to. There is no reason to go through the effort to recreate the Time picker
functionality.
I totally understand what you said. You are saying that , select only those time options applicable in times.conf settings and show it in default time picker. But, if user wants to see the stats for October month, then they will have to select "Date Range" from default time picker, and then select "between" and specify the dates manually there i.e. select 1st October and 31st October. Everytime if they want to change the month they have to manually go there and change from and end date, which they don't want. Instead they want the ready-made drop down showing list of months which I have already created and have attached screenshot for the same. The only thing is I want to append that drop down list with "Month to date" option in that ? and that is why I opened this question ? Hope you understood ?
NO!!!! You can create YOUR OWN BRAND NEW values for the timepicker and have them be ONLY the ones that you desire:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Timesconf