topic Setting time frame values dynamically for splunk dashboard in Dashboards & Visualizations

Setting time frame values dynamically for splunk dashboard

Ashwin3 — Tue, 12 Jul 2022 09:02:54 GMT

I have a use case where once a particular datetime is entered as input on the dashboard. Need to show search log results panel from two time frames side by side.

say if the entered value is "07/06/2022:14:00:00"

1) -1hr from the time period entered (here in this case "07/06/2022:13:00:00 -"07/06/2022:14:00:00"

2) From the time period entered to till now (here in this case "07/06/2022:14:00:00 -NOW"

I am capturing the datetime entered as a timetoken

how to set another time token relative to the value entered on screen in dashboard? so that i can use both these tokens as earliest and latest for the first usecase.

Thanks

Re: Setting time frame values dynamically for splunk dashboard

diogofgm — Tue, 12 Jul 2022 09:46:07 GMT

You can use relative_time to eval tokens in your dashboard

e.g -1h

<eval token="new_token">relative_time($timeToken$,"-1h")</eval>

As for the now you can just use your time field as a earliest token in the search itself.

On both cases you'll probably need to use strftime to process your timestamp token format

From docs:

https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/tokens

Re: Setting time frame values dynamically for splunk dashboard

Ashwin3 — Tue, 12 Jul 2022 10:33:17 GMT

Thank you. Will try once with this and confirm @diogofgm

<eval token="formatted_token">strptime($timeToken$,"%m/%d/%Y:%T")</eval>

<eval token="new_token">relative_time($formatted_token$,"-1h")</eval>

I am trying with the above one but looks like <eval> is not getting accepted as child node for any of the form elements like <input>, <fieldset> etc. where can we place this <eval> step in UI form?

Also is there a way where we can accept datetime as input directly from dashboard. Currently i see a Time input but it does not allow to select a particular time. Hence am using text field for getting the datetime value.

Thanks.

Re: Setting time frame values dynamically for splunk dashboard

diogofgm — Tue, 12 Jul 2022 11:29:11 GMT

Inside input > change tags. so it would be input > change > eval

Check this part of the docs I shared before:
https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/tokens#Define_tokens_for_conditional_operations_with_form_inputs

You could use a time picker since it already creates tokens for you. if you name your time picker timepicker you'll have $timepicker.earliest$ and $timepicker.latest$ and use these to then eval the new tokens