topic Time comparison - Relative and Explict in Dashboards & Visualizations

Time comparison - Relative and Explict

manas — Wed, 05 Nov 2025 06:07:15 GMT

I have a field which gives when a particular event started. Depending on time period selected in dashboard , i want to fetch all records past that time period selected in time picker input of the dashboard.

Problem is if time input is relative like "today" /"Yesterday" choice 1 below works and i get results. When time selected as input is explicit like "10/02/2025" ,choice 2 works and i get results.

Relative time logic :

|where timestamp2 >= relative_time(now(), "$field1.earliest$")

Explicit time logic :

|where timestamp2 >= tonumber("$field1.earliest$")

How to enhance this ,so that irrespective of input ,will get results.

Something like below does not work :

| eval earliest_time=if(isnum("$field1.earliest$"), tonumber("$field1.earliest$"), relative_time(now(), "$field1.earliest$"))

| where timestamp2 >= earliest_time

Re: Time comparison - Relative and Explict

ITWhisperer — Wed, 05 Nov 2025 09:05:03 GMT

Possibly the simplest answer is to let Splunk do it for you. You can use addinfo to get the search time settings and use them in your search

| addinfo | where timestamp2 >= info_min_time

Re: Time comparison - Relative and Explict

manas — Wed, 05 Nov 2025 15:08:10 GMT

This works . Thanks . I have multiple time pickers in dashboard as it's a comparison dashboard as given each widget has it's own time picker ,it works regardless.