https://community.splunk.com/t5/Splunk-Search/Yesterday-data-dashboard-filtering/m-p/700659#M237724 <P>Depending on how you have "removed" the timewrap command you could have a token which starts and ends a comment (```)</P><P>&nbsp;</P><LI-CODE lang="markup">index=foo $comment$ [| makeresults | fields - _time | addinfo | eval day=mvrange(0,2) | mvexpand day | eval earliest=relative_time(info_min_time,"-".day."d") | eval latest=relative_time(info_max_time,"-".day."d") | fields earliest latest] $comment$ | timechart span=1m sum(value) as value | eval _time=_time $comment$ | timewrap 1d $comment$</LI-CODE><P>&nbsp;</P> Tue, 01 Oct 2024 13:32:18 GMT ITWhisperer 2024-10-01T13:32:18Z https://community.splunk.com/t5/Splunk-Search/Yesterday-data-dashboard-filtering/m-p/700656#M237721 <P>An extension of this:<BR /><A href="https://community.splunk.com/t5/Splunk-Search/Looking-at-yesterdays-data-but-need-to-filter-the-data-to-only/m-p/696758#M236798" target="_blank" rel="noopener">https://community.splunk.com/t5/Splunk-Search/Looking-at-yesterdays-data-but-need-to-filter-the-data-to-only/m-p/696758#M236798</A></P><P>&nbsp;</P><P>I've created a dashboard on the above with an input that adds the timewrap line when the option is selected yes and nothing when the option is selected no.</P><P>&nbsp;</P><P>The issue I am having is when no is selected, the graph looks like the following when I select smaller time windows. Below I selected 4 hours but how can I only show the last 4 hours and not the previous window.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2024-10-01 at 13.48.49.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/32883iC19708E3950ABE2B/image-size/medium?v=v2&amp;px=400" role="button" title="Screenshot 2024-10-01 at 13.48.49.png" alt="Screenshot 2024-10-01 at 13.48.49.png" /><span class="lia-inline-image-caption" onclick="event.preventDefault();">Screenshot 2024-10-01 at 13.48.49.png</span></span></P><P>&nbsp;</P><P>Query is as follows:<BR /><BR />index=foo&nbsp;<BR />[| makeresults<BR />| fields - _time<BR />| addinfo<BR />| eval day=mvrange(0,2)<BR />| mvexpand day<BR />| eval earliest=relative_time(info_min_time,"-".day."d")<BR />| eval latest=relative_time(info_max_time,"-".day."d")<BR />| fields earliest latest]<BR />| timechart span=1m sum(value) as value | eval _time=_time</P><P> </P> Tue, 01 Oct 2024 12:52:19 GMT https://community.splunk.com/t5/Splunk-Search/Yesterday-data-dashboard-filtering/m-p/700656#M237721 nelesama 2024-10-01T12:52:19Z https://community.splunk.com/t5/Splunk-Search/Yesterday-data-dashboard-filtering/m-p/700659#M237724 <P>Depending on how you have "removed" the timewrap command you could have a token which starts and ends a comment (```)</P><P>&nbsp;</P><LI-CODE lang="markup">index=foo $comment$ [| makeresults | fields - _time | addinfo | eval day=mvrange(0,2) | mvexpand day | eval earliest=relative_time(info_min_time,"-".day."d") | eval latest=relative_time(info_max_time,"-".day."d") | fields earliest latest] $comment$ | timechart span=1m sum(value) as value | eval _time=_time $comment$ | timewrap 1d $comment$</LI-CODE><P>&nbsp;</P> Tue, 01 Oct 2024 13:32:18 GMT https://community.splunk.com/t5/Splunk-Search/Yesterday-data-dashboard-filtering/m-p/700659#M237724 ITWhisperer 2024-10-01T13:32:18Z https://community.splunk.com/t5/Splunk-Search/Yesterday-data-dashboard-filtering/m-p/700662#M237725 <P>Hi,</P><P>The token element works well but when no has been selected from the filter, nothing extra is added to the code. I was wondering how I can stop the graph from being split in two when no is selected</P> Tue, 01 Oct 2024 13:42:37 GMT https://community.splunk.com/t5/Splunk-Search/Yesterday-data-dashboard-filtering/m-p/700662#M237725 nelesama 2024-10-01T13:42:37Z https://community.splunk.com/t5/Splunk-Search/Yesterday-data-dashboard-filtering/m-p/700666#M237727 <P>What happens when you tried my solution?</P> Tue, 01 Oct 2024 13:56:47 GMT https://community.splunk.com/t5/Splunk-Search/Yesterday-data-dashboard-filtering/m-p/700666#M237727 ITWhisperer 2024-10-01T13:56:47Z https://community.splunk.com/t5/Splunk-Search/Yesterday-data-dashboard-filtering/m-p/700689#M237739 <P>Ahh I see what you mean.</P><P>Never though to use the comment like that and several times.</P><P>Thank you</P> Tue, 01 Oct 2024 16:23:32 GMT https://community.splunk.com/t5/Splunk-Search/Yesterday-data-dashboard-filtering/m-p/700689#M237739 nelesama 2024-10-01T16:23:32Z