We have a dashboard and wanted to add text fields to enter start date with time and end date with time say
(11/13/2019 08:00 pm - 11/14/2019 10:00 AM) so that dashboard should be updated according to the time period.
Hi
Try this, i didn't added validation for date/time field.
<form>
<label>filter</label>
<fieldset submitButton="false">
<input type="text" token="startdate" searchWhenChanged="true">
<label>Start Date (mm/dd/yyyy hh:mm AM/PM)</label>
<change>
<condition>
<eval token="new_earliest">strptime(startdate,"%m/%d/%Y %H:%M %p")</eval>
</condition>
</change>
</input>
<input type="text" token="enddate" searchWhenChanged="true">
<label>End Date Start Date (mm/dd/yyyy hh:mm AM/PM)</label>
<change>
<condition>
<eval token="new_latest">strptime(enddate,"%m/%d/%Y %H:%M %p")</eval>
</condition>
</change>
</input>
</fieldset>
<row depends="$startdate$ $enddate$">
<panel>
<table>
<search>
<query>index=_internal earliest=$new_earliest$ latest=$new_latest$ |stats count by action, host</query>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
Hi
Try this, i didn't added validation for date/time field.
<form>
<label>filter</label>
<fieldset submitButton="false">
<input type="text" token="startdate" searchWhenChanged="true">
<label>Start Date (mm/dd/yyyy hh:mm AM/PM)</label>
<change>
<condition>
<eval token="new_earliest">strptime(startdate,"%m/%d/%Y %H:%M %p")</eval>
</condition>
</change>
</input>
<input type="text" token="enddate" searchWhenChanged="true">
<label>End Date Start Date (mm/dd/yyyy hh:mm AM/PM)</label>
<change>
<condition>
<eval token="new_latest">strptime(enddate,"%m/%d/%Y %H:%M %p")</eval>
</condition>
</change>
</input>
</fieldset>
<row depends="$startdate$ $enddate$">
<panel>
<table>
<search>
<query>index=_internal earliest=$new_earliest$ latest=$new_latest$ |stats count by action, host</query>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
Hi @vnravikumar, Thank you for your response.
The start time and end time works fine but our base search pulling the resullts for current, last 7 days ,14 days , 21 days , 28 days . If we select the start and end time say (10/13/2019 10:00 - 10/13/2019 11:00). It's pulling the results along with current, last 7 days , 14 days .. with the time period (10-11). We only need to pull the data for selected time period. Here is our base query
| multisearch
[ search index=foo sourcetype=bar earliest=-0d@d latest=now
| eval label="Colomn1"
| fields -_raw _time apple label ]
[ search index=foo sourcetype=bar earliest=-7d@d latest=-7d@d
| eval _time=_time+60*60*24*7
| eval label="Colomn2"
| fields -_raw _time apple label ]
[ search index=foo sourcetype=bar earliest=-14d@d latest=-14d@d
| eval _time=_time+60*60*24*14
| eval label="Colomn3"
| fields -_raw _time apple label ]
[ search index=foo sourcetype=bar earliest=-21@d latest=-21@d
| eval _time=_time+60*60*24*21
| eval label="Colomn4"
| fields -_raw _time apple label ]
[ search index=foo sourcetype=bar earliest=-28@d latest=-28@d
| eval _time=_time+60*60*24*28
| eval label="Colomn5"
| fields -_raw _time apple label]
| bin _time span=5m
| chart dc(apple) over _time by label
| eval "Colomn1 4 Week Avg"=('Colomn2'+Colomn3+Colomn4+Colomn5)/4
| eval "Colomn2 4 Week Avg"=abs('Colomn2'-'Colomn1')
| eval "Diff of Colomn1 and 4 Week Avg."=abs('Colomn5'-'Colomn1')
| eval Est_Impact= abs('Diff of Colomn1 and Colomn2'-'Colomn5.')
| fields _time "Colomn1" "Colomn2" "Colomn3" "Colomn4" "Colomn5"
|search colomn1!=0