topic Re: How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen? in Splunk Search

How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen?

praspai — Mon, 19 Oct 2015 14:09:31 GMT

Hi,

I want the time span in a search to adjust based upon the time picker value.

i.e.

time picker is day, then span=1h
month, then span=1d
year, then span=1month

thanks ..

Re: How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen?

somesoni2 — Mon, 19 Oct 2015 14:31:52 GMT

You can try any of these two methods

https://answers.splunk.com/answers/218928/how-to-dynamically-change-the-span-parameter-for-a.html

https://answers.splunk.com/answers/79779/passing-span-as-argument-to-timechart.html

Re: How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen?

woodcock — Mon, 19 Oct 2015 23:47:00 GMT

Like this:

| makeresults
| addinfo
| eval timepickerSpanSeconds=(info_max_time - info_min_time)
| eval spanToken=case(timepickerSpanSeconds>=31536000, "1m",
                      timepickerSpanSeconds>=604800,   "1d",
                      timepickerSpanSeconds<60,        "1s",
                      timepickerSpanSeconds<3600,      "1m",
                      true(),                          "1h")
| map search="search index=* earliest=$info_min_time$ latest=$info_max_time$ | timechart count span=$spanToken$ BY host"

Re: How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen?

praspai — Tue, 20 Oct 2015 14:25:42 GMT

Its perfectly working in searches but not in Dashboard. Its not picking value from time picker

Re: How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen?

woodcock — Tue, 20 Oct 2015 15:18:24 GMT

That's the best I have.

Re: How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen?

woodcock — Tue, 20 Oct 2015 15:20:40 GMT

You have to play around with the dollar-sign because it is used both by the XML and by the map command in the search. Try adding a second one to each occurrence.

Re: How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen?

praspai — Wed, 21 Oct 2015 06:25:29 GMT

Thanks ...

Re: How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen?

woodcock — Sat, 27 Feb 2016 02:51:27 GMT

You can also do it like this:

... | timechart [
|makeresults 
| addinfo 
| eval timepickerSpanSeconds=(info_max_time - info_min_time) 
| eval span=case(
   timepickerSpanSeconds>=31536000, "1m", 
   timepickerSpanSeconds>=604800, "1d", 
   timepickerSpanSeconds<60, "1s", 
   timepickerSpanSeconds<3600, "1m", 
   true(), "1h") 
| table span 
| format "" "" "" "" "" ""] count BY host

This solution avoids the whole dollar-sign problem entirely.

Re: How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen?

dbcase — Thu, 15 Sep 2016 20:27:08 GMT

modify this earliest=$info_min_time$ latest=$info_max_time$ to look like this earliest=$$info_min_time$$ latest=$$info_max_time$$