topic Re: Relative Time Value to Timepicker Latest in Splunk Search

Relative Time Value to Timepicker Latest

hypePG — Tue, 12 Mar 2019 18:57:19 GMT

Hey,

I got a dashboard with different panels. They are all controlled by a single timepicker.
Usually the timeranges a several weeks. In one of the panels I want an overview for the last 24 hours relative to the latest time.

For Example:

Time range picked via the picker:
01.03.2019-8.03.2019
24h Overview should display events for this range:
07.03.2019-8.03.2019

I tried working with tokens and different method to calculate the new earliest time but didnt get it to work.
I think it will be a simple fix but I jsut cant get it atm.

Thanks in advance.

Max

Re: Relative Time Value to Timepicker Latest

vnravikumar — Wed, 13 Mar 2019 04:40:56 GMT

Hi @hypePG

Try like in that panel with

<row>
    <panel>
      <table>
        <search>
          <query>index="_internal" |stats count</query>
          <earliest>-24h@h</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>

Re: Relative Time Value to Timepicker Latest

hypePG — Wed, 13 Mar 2019 08:49:06 GMT

hey,

thanks for your answer! tried this already, i get the error message:

Invalid latest_time: latest_time must be after earliest_time.

regards,

max

Re: Relative Time Value to Timepicker Latest

vnravikumar — Wed, 13 Mar 2019 08:51:30 GMT

are you passing timepickers latest time?

Re: Relative Time Value to Timepicker Latest

hypePG — Fri, 15 Mar 2019 13:45:28 GMT

yes i am:

    <search>
      <query>search</query>
      <earliest>-24h@h</earliest>
      <latest>$timepicker.latest$</latest>
      <sampleRatio>1</sampleRatio>
    </search>

Re: Relative Time Value to Timepicker Latest

vnravikumar — Fri, 15 Mar 2019 16:20:56 GMT

what is the time range that you have selected?