topic Using a different time picker on an inner query in Splunk Search

Using a different time picker on an inner query

ShagVT — Tue, 25 Aug 2020 14:13:43 GMT

I'm working on dashboard in which I would like to compare data across two different time periods. (I posted a previous question here: https://community.splunk.com/t5/Splunk-Search/Compare-percentages-with-a-week-ago/m-p/513799#M144200)

I would like to have two time pickers on my dashboard. The first would be for time period 1 and the second would be for time period 2. I have much of this worked out conceptually ... but I don't see how to have the second time picker work for the inner query. In its simplest form it would look something like this:

| append [search <base query> $timePicker2$]

| <collate data>

The question is how to make that timePicker2 actually work. I have this working with just a dropdown that includes a handful of preset values like earliest=-169h@h latest=-168h@h to be "same hour last week" but if i wanted to make it more flexible with a time picker, I don't understand how to make that work.

Re: Using a different time picker on an inner query

isoutamo — Tue, 25 Aug 2020 14:35:47 GMT

did this help you?

https://community.splunk.com/t5/Dashboards-Visualizations/Is-it-possible-to-override-a-base-search-lt-earliest-gt-and-lt/td-p/505207

r. Ismo

Re: Using a different time picker on an inner query

ShagVT — Tue, 25 Aug 2020 16:58:51 GMT

@isoutamo - thanks for the link. I don't see how to make that work. How would I connect the time picker only to the inner search? In that example, it looks like there are two separate queries in which the entire query is driven by its own picker, so I think that is solving a different problem.