I have a time input, which I need to use to filter results of a search based on a date field in the search results. For example, this date could be birthdate for an account of some sort, and I want to filter on the birthdate, rather than the _time, which is when the information is logged. First, I am parsing out the birthdate with a regular expression, then converting it to seconds since the epoch, so I will have a numeric value I can use to compare.
With the following, my panel indefinitely shows "Search is waiting for input." Previously, I was not doing this birthdate comparison, and was simply using <earliestTime> and <latestTime> with the $field1.earliest$ and $field1.latest$ values, respectively. At this time, I got results, so I know the data is there.
I know that $field1.earliest$ is initially 0, so I tried removing all cases other than the first one, which is for matching a numeric string. My expectation was that this would remedy the problem for the initial setting, and I could work on adding the other match cases. However, the panel continued to display "Search is waiting for input."
Included below is the relevant code: first, the time input; followed by the panel with the search string.
Thanks for any help!
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
</fieldset>
<panel>
<table>
<title>User name</title>
<searchString>index=X app=Y "username"| rex field=message "<BirthDatet>(?<BirthDate>.+)<\/BirthDate>" | eval birthDateTime = strpTime(BirthDate,"%Y-%m-%d")
| eval StartTime = case(match($field1.earliest$,"^\d+\.?\d*$"),$field1.earliest$,
match($field1.earliest$,"^.*([A-Z]|[a-z]).*$"),relative_time(now(),$field1.earliest$),
match($field1.earliest$,"^.+\/.+$"),auto($field1.earliest$),
1=1, 0)
| where birthDateTime > StartTime
</searchString>
<earliestTime>0</earliestTime>
<latestTime>$field1.latest$</latestTime>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
... View more