https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-from-600-seconds-before-to-600-seconds-after-the/m-p/604306#M13149 <LI-CODE lang="markup">&lt;form&gt; &lt;label&gt;Time Picker token&lt;/label&gt; &lt;init&gt; &lt;eval token="earliest10minutesbefore"&gt;relative_time(now(),"-10m")&lt;/eval&gt; &lt;eval token="latest10minutesafter"&gt;relative_time(now(),"+10m")&lt;/eval&gt; &lt;/init&gt; &lt;fieldset submitButton="false"&gt; &lt;input type="time" token="time" searchWhenChanged="true"&gt; &lt;label&gt;&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;@d&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;change&gt; &lt;condition&gt; &lt;eval token="earliest10minutesbefore"&gt;relative_time(relative_time(now(),$time.earliest$),"-10m")&lt;/eval&gt; &lt;eval token="latest10minutesafter"&gt;relative_time(relative_time(now(),$time.latest$),"+10m")&lt;/eval&gt; &lt;/condition&gt; &lt;/change&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;10 minute buffer&lt;/title&gt; &lt;table&gt; &lt;search&gt; &lt;query&gt;| makeresults | eval earliest10minutesbefore= $earliest10minutesbefore$, latest10minutesafter=$latest10minutesafter$ | eval earliest_time=strftime(earliest10minutesbefore,"%Y-%m-%dT%H:%M:%S"), latest_time=strftime(latest10minutesafter,"%Y-%m-%dT%H:%M:%S") | table earliest_time, latest_time, earliest10minutesbefore, latest10minutesafter | fields - _time&lt;/query&gt; &lt;earliest&gt;$earliest10minutesbefore$&lt;/earliest&gt; &lt;latest&gt;$latest10minutesafter$&lt;/latest&gt; &lt;/search&gt; &lt;option name="drilldown"&gt;none&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;/table&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt;</LI-CODE> Mon, 04 Jul 2022 10:38:10 GMT ITWhisperer 2022-07-04T10:38:10Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-from-600-seconds-before-to-600-seconds-after-the/m-p/603757#M13062 <P>I would like to search from 600 seconds before to 600 seconds after the time specified in the time picker on the dashboard. Is there a good idea?<BR /><BR />The time picker is also used in another panel, so it is in response to the request that I&nbsp;didn't want to place multiple time pickers.<BR /><BR />=== This SPL did not pass. ===<BR />index = _internal<BR />earliest = $ field1.earliest $ --600<BR />latest = $ field1.earliest $ + 600</P> Wed, 29 Jun 2022 21:03:53 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-from-600-seconds-before-to-600-seconds-after-the/m-p/603757#M13062 Msugiyama 2022-06-29T21:03:53Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-from-600-seconds-before-to-600-seconds-after-the/m-p/604108#M13123 <P>You could add a change handler to the timepicker to evaluate new tokens based on the values chosen and use those new tokens for your earliest and latest values.</P> Fri, 01 Jul 2022 11:20:27 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-from-600-seconds-before-to-600-seconds-after-the/m-p/604108#M13123 ITWhisperer 2022-07-01T11:20:27Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-from-600-seconds-before-to-600-seconds-after-the/m-p/604300#M13148 <P>Thank you for reply<BR />What you want to search is the log related to the input to the form of the web page.</P><P>When "Today" is specified in the time picker<BR />I can't search for a start and end if started a session at 23:50 yesterday and the session expires at 0:10 today.<BR />For the time being, I would like to set up a buffer for about 10 minutes.</P> Mon, 04 Jul 2022 10:05:53 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-from-600-seconds-before-to-600-seconds-after-the/m-p/604300#M13148 Msugiyama 2022-07-04T10:05:53Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-from-600-seconds-before-to-600-seconds-after-the/m-p/604306#M13149 <LI-CODE lang="markup">&lt;form&gt; &lt;label&gt;Time Picker token&lt;/label&gt; &lt;init&gt; &lt;eval token="earliest10minutesbefore"&gt;relative_time(now(),"-10m")&lt;/eval&gt; &lt;eval token="latest10minutesafter"&gt;relative_time(now(),"+10m")&lt;/eval&gt; &lt;/init&gt; &lt;fieldset submitButton="false"&gt; &lt;input type="time" token="time" searchWhenChanged="true"&gt; &lt;label&gt;&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;@d&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;change&gt; &lt;condition&gt; &lt;eval token="earliest10minutesbefore"&gt;relative_time(relative_time(now(),$time.earliest$),"-10m")&lt;/eval&gt; &lt;eval token="latest10minutesafter"&gt;relative_time(relative_time(now(),$time.latest$),"+10m")&lt;/eval&gt; &lt;/condition&gt; &lt;/change&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;10 minute buffer&lt;/title&gt; &lt;table&gt; &lt;search&gt; &lt;query&gt;| makeresults | eval earliest10minutesbefore= $earliest10minutesbefore$, latest10minutesafter=$latest10minutesafter$ | eval earliest_time=strftime(earliest10minutesbefore,"%Y-%m-%dT%H:%M:%S"), latest_time=strftime(latest10minutesafter,"%Y-%m-%dT%H:%M:%S") | table earliest_time, latest_time, earliest10minutesbefore, latest10minutesafter | fields - _time&lt;/query&gt; &lt;earliest&gt;$earliest10minutesbefore$&lt;/earliest&gt; &lt;latest&gt;$latest10minutesafter$&lt;/latest&gt; &lt;/search&gt; &lt;option name="drilldown"&gt;none&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;/table&gt; &lt;/panel&gt; &lt;/row&gt; &lt;/form&gt;</LI-CODE> Mon, 04 Jul 2022 10:38:10 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-from-600-seconds-before-to-600-seconds-after-the/m-p/604306#M13149 ITWhisperer 2022-07-04T10:38:10Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-from-600-seconds-before-to-600-seconds-after-the/m-p/604441#M13163 <P>This is awesome!!<BR />Resolved. Thanks!</P><P>I will relearn about TOKEN.</P> Tue, 05 Jul 2022 12:46:31 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-search-from-600-seconds-before-to-600-seconds-after-the/m-p/604441#M13163 Msugiyama 2022-07-05T12:46:31Z