Splunk Enterprise: Exclude certain time ranges for a bigger time range - monitoring

I am in need of knowing if there is a possibility to exclude certain time ranges within a given time period? I have a formula for my search and then I have chosen the datepicker, but would like to know if I can filter out specific time ranges within what I already have chosen?
Or is the only way out to make multiple searches from the datepicker menu?
Thanks a lot

The way to filter time the way you're describing is by putting it directly in your SPL instead of using the time picker using earliest and latest
For example:
index=ndx sourcetype=srctp ((earliest=-24d latest=-20d) OR (earliest=-10d latest=-6d)
| <rest of SPL>

Related

How to create a custom filter using a user input control in Google Looker Studio

I have a table of events from google sheets that I want users to be able to filter by date in Google Looker Studio. The events have various lengths, so each has a start and an end date in the table (as well as a bunch of other columns). For example:
Event
Start Date
End Date
A
02/15/2023
02/20/2023
B
03/01/2023
04/30/2023
C
02/23/2023
03/01/2023
I want users to be able to filter for anything that is happening in the event range they select. For example, if they input the date range 02/26/2023 - 03/15/2023, the table should filter down to show events B and C, since those have ranges overlapping their input data range.
I've tried a few different approaches that all have drawbacks:
Using the Looker Studio date range control. This seems to only filter based on the Start Date OR the End Date, and not have the ability to look at both.
Applying a Date Filter in the chart. If I apply the following filter (under Chart - Filter - Table Filter), it works great to show anything overlapping the desired date range:
Include - Start Date - Less than or equal to - 03/15/2023
AND
Include - End Date - Greater than or equal to - 02/26/2023
However, I had to put these dates directly into the filter, which is not what the user should have to do. Is there a way I can have them input the date range they are interested as a control, and I can feed that information into the Date Filter above? (So they would put in a start date and end date that would replace where I have hard coded 02/26/2023 and 03/15/2023 above).
I have also set up this filter in Google Sheets to work exactly as I want it. Anyone can enter a start date and end date in a couple cells, and I use the filter() function with the same logic as in #2 above to filter the table down to what I want. The disadvantage of google sheets though, is if multiple people are there at the same time, they do not have their own view of the report. I switched to Looker Studio because it allows view-only users to filter their report independently.
Edited to add: This report is intended to be used by viewers with limited experience using google sheets or looker studio, and possibly on phone or browser, so I'm trying to make the filtering as easy as possible.
the ability to filter data independently & at the same time for multiple users is natively possible in google sheets with Filter Views:

set times with miliseconds in google sheet [duplicate]

This question already has answers here:
How to SUM duration in Google Sheets?
(5 answers)
Closed 8 months ago.
some time ago I ported an old timesheet to the google-timesheet to be able to share it online and have others modify it but didn't keeped it so I don't remember how I manage to do.
The goal is to compare two timing sheet, today I wanted to edit the sheet to be able add new datas and write timing in separate page sheet which simplify the comparation as I'll just have to import the data from the page and not rewrite it all the time. My issue is that I'm not enable to replicate on my new pages the format. What I would like is to have this exemple working
Cities
Time
Helsinki
2:04.820
Travemünde
4:03.290
Hambourg
0:30.900
Hanovre
2:28.610
Francfort
4:53.470
Mannheim
1:35.170
Strasbourg
2:13.650
Berne
2:25.190
Genève
2:22.620
Lyon
2:24.000
Marseille
3:34.550
Marseille (ferry)
Palerme
2:28.670
Catania
4:07.670
Total
=SUM(above)
so that I can replicate the format on the other pages as I don't understand why it worked before but not now.
mm:ss.000 is the format I would like to have, but atm my format is [h]:mm:ss.000 and it seems that the hour markdown is necesary so I don't really mind if we need to keep the hour.
This is completely possible with google sheets. Enter the data in the format hh:mm:ss.ms, and use sum() (with a range, obv.) to sum the column. Then select the whole colume and apply a custom number format (data-> custom time/date). Using the dropdown to get the parts and typing the separators you can get Minute(1): Seconds(1).Milliseconds(3) which seems to be what you want.
For sheets to recognise the cell entry as a time it needs the hh: part. But you can certainly hide that in the display.
Demo Spreadsheet
If the spreadsheet locale is set to something which uses , for the decimal point, you need to use that instead of . Google could definitely make that a lot clearer. If you have the time you might even want to open a bug report with them, as the examples in their docs don't work when the locale requires a ,.
As a bonus, you can bulk-convert using a formula like =replace(B2; find("."; B2); 1; ",") * 1 (where B2 is the cell to be converted). Drag down, copy and paste the values, and then format if need be.
use:
=ARRAYFORMULA(TEXT(SUM(IFERROR(TIMEVALUE("0:"&B1:B15))); "[m]:ss.000"))

Multiple criteria Countif unable to match due to date range, importrange

I am attempting to build a live dashboard for our lovely mechanics to see how many services they have completed in a day. The majority of the time it will be used to only show services from a certain mechanic on today's date, however I would like to be able to change the date it shows date for and so would like to be able to grab that criteria from a certain cell in sheet.
My current thinking is that the dashboard would have a formula like this:
=COUNTIFS(
IMPORTRANGE(
"https://docs.google.com/spreadsheets/d/1bx65qPAChwZ8uxwJsMfh-w5uALdKVdnn8x7LXD6J3zs",
"Servicing!A:A"),
D1,
IMPORTRANGE(
"https://docs.google.com/spreadsheets/d/1bx65qPAChwZ8uxwJsMfh-w5uALdKVdnn8x7LXD6J3zs",
"Servicing!C:C"),
C7)
D1 is where i can put in the date. C7 is where the mechanics name is held. My thinking is that this is not working as the data is populated using a google form. This google form records a timestamp in the following way '3/13/2020 12:09:56' Meaning that It will only match this data if the exact same time matches. Is there a way to make it search for ALL records on a date instead of all from a precise time?
Thanks for reading!
I was able to remove the time from the google forms output by adding and extra column and using this formula
=TO_DATE(DATEVALUE(B805))
B805 is filled by the time stamp from the google form
I then made my formula search for the info in the new colum with the above in each cell. It worked! :)

Angular bootstrap datetime picker

Though there are various good datetime pickers available, I'm looking for a single component which has all these following features -
Date and time selection in one go
Only date selection
Only time selection
Multiple dates selection (Not to be misunderstood with date range selection)
I'm unable to find a component which has all the above. The reason behind I'm looking for a single component instead of using multiple components is consistent UX and optimum performance.
Here's one built off of ngBootstrap. The ngBootstrapCalendar control supports multiple date selections.
https://stackblitz.com/edit/angular-datetimepicker

history attribute in neo4j

I was reading about Time-Based Versioned Graphs and came across the following example:
CREATE (s1:Shop{shop_id:1})
-[:STATE{from:1388534400000,to:9223372036854775807}]->
(ss1:ShopState{name:'General Store'})
My question: how do I calculate this date? from:1388534400000,to:9223372036854775807
Those two values are timestamps which in java are the number of milliseconds since the Epoch (1/1/1970) began. The second value is the maximum Long value, the end of Java time, a long way away.
There are ways in all languages for generating these values for specific dates (beware that some will be based on seconds), there is quite a handy list on this site.
If you are not working in any particular programming language and just want to enter queries then you can use an online date converter like this one.
You can also calculate timestamps in Cypher if you are working with dates that relate to Now somehow using the timestamp() function:
CREATE (s1:Shop{shop_id:1})
-[:STATE{from:timestamp(),to:9223372036854775807}]->
(ss1:ShopState{name:'General Store'})
IIUC to is just a Long.MAX_VALUE, and from can be a result of either calling timestamp() function via Cypher or setting the property with the value of System.currentTimeMills() via Java API.
Take a look at the example: http://console.neo4j.org/?id=43uoyt (Note that you can skip setting rel.to and use coalesce when querying instead).

Resources