topic Re: Panel to display n days before data based upon time picker selected in Dashboards & Visualizations

Panel to display n days before data based upon time picker selected

irvanramuk — Tue, 10 Sep 2019 04:27:42 GMT

Hi,

Am trying to have two panels with one showing the data corresponding to the range selected in time picker and the other panel showing data for the same time range but 7 days earlier. Have tried using eval to assign the 7d time range into tokens (after searching online).

    <input type="time" token="Time_Range" >
      <label>Time</label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
      <change>
        <eval token="weekearliest">relative_time(relative_time(time(), "$earliest$"), "-7d")</eval>
        <eval token="weeklatest">relative_time(relative_time(time(), "$latest$"), "-7d")</eval>
      </change>
    </input>

Have added the tokens initialized weekearliest and weeklatest as token based search in another panel but it doesnt seems to work,

          <earliest>$weekearliest$</earliest>
          <latest>$weeklatest$</latest>

Can kindly provide pointers to check on how to implement them?

Re: Panel to display n days before data based upon time picker selected

Sukisen1981 — Wed, 30 Sep 2020 02:09:37 GMT

your token is time_range, so your evals on change tags should look something like this relative_time(relative_time(time_range, "$earliest$"), "-7d") <eval token="weeklatest">relative_time(relative_time(time_range, "$latest$"), "-7d")</eval>

Re: Panel to display n days before data based upon time picker selected

maciep — Sun, 15 Sep 2019 12:58:59 GMT

Played with this on Splunk 7.1.x. I have always created a search, used addinfo to the earliest latest, manipulated them as needed and then created tokens to use elsewhere. But I like your approach too.

Anyway, I removed some quotes and added a check for the case when latest is now...because that didn't seem to work as a modifier in the relative_time() function. Also, you may need to account for the all time scenario too...

Here's a very simple dashboard that just shows the tokens in the title of an empty panel.

<form>
  <label>Timepicker Test</label>
  <fieldset>
    <input type="time" token="Time_Range" searchWhenChanged="true">
      <label>Time</label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
      <change>
        <eval token="weekearliest">relative_time(relative_time(now(),$earliest$,-7d)</eval>
        <eval token="weeklatest">if($latest$="now",now(),relative_time(now(),$latest$)</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$weekearliest$   $weeklatest$</title>
      <single>
        <search>
          <query/>
        </search>
      </single>
    </panel>
  </row>
</form>