topic Re: Subtract time from time picker token response in Dashboards & Visualizations

Subtract time from time picker token response

jeffreyleavy — Fri, 07 Feb 2020 13:59:05 GMT

So I have a "complex search" on a dashboard with a search and a subsearch. I currently have two time pickers on said dashboard, but would like only one. The main search is looking at timepicker1 via token1, and the subsearch is looking at timepicker2 via token2. What I want to do is have the subsearch look at token1 and take 7 days off, so I can do a comparison. so "selectedtime-7d". Is something like this possible. I have done quite a bit of tinkering with no success.

EX: index=logs appname=web earliest=$token1.earliest$ latest=$token1.latest$ | appendcols [search index=logs appname=web earliest=$token2.earliest$ latest=$token2.latest$]

In theory for the subsearch I would like it to be something like [search index=logs appname=web earliest=($token1.earliest$-7d) latest=($token1.latest$-7d) ]

Any way to make this happen?

Re: Subtract time from time picker token response

paulbannister — Wed, 30 Sep 2020 04:08:30 GMT

HI There

One thing you could try is adding a base search to the dashboard who's sole purpose is to generate these secondary time tokens for you using makeresults, then pull the tokens from this to use in the other search

|makeresults
|eval new_earliest=$token1.earliest$-604800, new_latest=$token1.latest$-604800

A little crude but should do the job

Re: Subtract time from time picker token response

jeffreyleavy — Fri, 07 Feb 2020 20:07:35 GMT

How would I go about doing that? I have never used makeresults before, and this is my first time with tokens as well.

Re: Subtract time from time picker token response

martin_mueller — Fri, 07 Feb 2020 20:20:50 GMT

I believe you're looking for this.

https://answers.splunk.com/answers/558071/how-to-subtract-date-for-a-timechart-panel-from-th.html#answer-558579