How to generate earliest and latest from a date passed on form

[phoenixdigital]

Hi All,

I am hoping to have a dashboard where the user can select a month and year and then this automatically generate an earliest and latest based on the beginning of that month(+6h) and the end of that month(+6h)

I can manually do the search which sums the data correctly per month

sourcetype=usage-data key="2344" earliest="@year+6h" latest="@mon+6h" | eval _time=_time - 21600 |  timechart span=mon sum(usage) as totalUsage

What I want though is the ability to give the user a simple interface which will return that month's data. There will be about another 20 searches which will use this same date range.

If your wondering why I have to add 6 hours. The days usage count starts from 6am every day.

Any help would be greatly appreciated.

[martin_mueller · Accepted solution]

One way to achieve this would be with an eval-based macro like this one:

relative_time(strptime("$year$-$month$-01", "%Y-%m-%d"), "+$offset$mon+6h")

To test this you can use a query like this:

index=foo earliest=`from_month("2013", "02", "0")` latest=`from_month("2013", "02", "1")` | stats count | addinfo | fieldformat info_min_time = strftime(info_min_time, "%+") | fieldformat info_max_time = strftime(info_max_time, "%+")

Where 2013 and 02 would be values passed in from your form.

[phoenixdigital]

That is perfect. Thank you Martin!

I must say this forum is a wealth of information and constantly opens my eyes up to features of Splunk I have barely touched.

Well done to all involved. When my workload lessens I plan to keep an eye on these threads and give back for all the wealth of knowledge that all here provide.

Thanks again