topic Re: How to offset the token from a time picker in Dashboards & Visualizations

How to offset the token from a time picker

duesser — Tue, 05 Dec 2023 09:00:06 GMT

I basically have the exact same question as https://community.splunk.com/t5/Dashboards-Visualizations/How-to-have-a-panel-use-an-offset-from-a-time-picker/m-p/351003.

BUT I need to actually change the value in the timerange picker token. E.G. if i select a timerange of "last 4 hour" and my modification is to add an hour, than the $token_time.earliest$ should not be "-4h" but "-5h".

Re: How to offset the token from a time picker

ITWhisperer — Tue, 05 Dec 2023 12:13:35 GMT

Create a new token in the change handler for the timepicker which is based on an hour difference to the timepicker earliest value. If you start changing the timepicker itself, this will be seen as a change which will then add another hour, which will be seen as a change, and so on.

Re: How to offset the token from a time picker

PickleRick — Tue, 05 Dec 2023 13:51:26 GMT

Also - you can "stack up" time specifiers. Look at this example:

Re: How to offset the token from a time picker

duesser — Wed, 06 Dec 2023 06:30:07 GMT

I am aware of this, however I was not able to accomplish this. Could you specify HOW EXACTLY you would accomplish this - e.g. shift earliest to earliest-1h within the input part of XML?

Re: How to offset the token from a time picker

duesser — Wed, 06 Dec 2023 06:31:34 GMT

I am aware of this, which is why I linked the question where this was answered already. I need to change the token within the XML dashboard.

Re: How to offset the token from a time picker

PickleRick — Wed, 06 Dec 2023 08:23:17 GMT

But why exactly do you want to change the token itself? Isn't it enough to skew the timerange for the resulting search?

Re: How to offset the token from a time picker

duesser — Wed, 06 Dec 2023 08:25:01 GMT

I am loading the search from a datamodel, so I can not do

| datamodel earliest=$<time_token>$-1h

Re: How to offset the token from a time picker

ITWhisperer — Wed, 06 Dec 2023 08:46:57 GMT

Try something like this

<change> <eval token="starttime">relative_time($timepicker.earliest$","-1h")</eval> <eval token="finishtime">relative_time($timepicker.latest$","-1h")</eval> </change>

Re: How to offset the token from a time picker

duesser — Thu, 07 Dec 2023 10:19:28 GMT

This does not work for me. It evaluates to "NaN". I guess the issue beeing, that $timepicker.xxx$ is filled with "-24h@h" for example, rather than UNIX time. Maybe it would make sense to post this as a seperate question. "how to convert "-24h@h" or so into UNIX time"?

Re: How to offset the token from a time picker

ITWhisperer — Thu, 07 Dec 2023 10:24:26 GMT

Try this - although this doesn't work with all options from time pickers - I haven't found an easy way to deal with all options.

<change> <eval token="starttime">relative_time(relative_time(now(),$timepicker.earliest$),"-1h")</eval> <eval token="finishtime">relative_time(relative_time(now(),$timepicker.latest$),"-1h")</eval> </change>

Re: How to offset the token from a time picker

duesser — Thu, 07 Dec 2023 10:28:52 GMT

When does it not work? For my intends and purposes it is sufficient! Thank you alot!

Re: How to offset the token from a time picker

ITWhisperer — Thu, 07 Dec 2023 11:45:09 GMT

iirc it is when you use "last hour" (for example) as the latest become the string "now" which confuses relative_time although it might also be when you use advanced as you can get an epoch time.

Re: How to offset the token from a time picker

la_yaki — Wed, 21 May 2025 17:31:09 GMT

Thank you!