Dashboards & Visualizations

Advanced Time Picker not returning correct value

hawifaris
Loves-to-Learn

I have set a default custom time to between last week and this week Thursday, however the latest time is not being reflected correctly in the token myTimepickerUnixLatest. Instead, the myTimepickerUnixLatest token ends up being the exact same as myTimepickerUnixEarliest. I am not sure where I am going wrong, I believe the fault is lying in relative_time(now(),'latest').

<input type="time" token="time">
  <label></label>
  <default>
    <earliest>@w4</earliest>
    <latest>+1w@w4</latest>
  </default>
  <change>
    <eval token="myTimepickerUnixEarliest">if(isnum('earliest'),'earliest',relative_time(now(),'earliest'))</eval>
    <eval token="myTimepickerUnixLatest">if(isnum('latest'),'latest',relative_time(now(),'latest'))</eval>
    <eval token="myTimepickerEarliest">strftime(myTimepickerUnixEarliest, "%B %d %Y %H:%M:%S")</eval>
    <eval token="myTimepickerLatest">strftime(myTimepickerUnixLatest, "%B %d %Y %H:%M:%S")</eval>
  </change>
</input>
0 Karma

niketn
Legend

@hawifaris please refer to one of my older answer to achieve this using independent search as a workaround since earliest and latest token do not work as expected: https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html

There are two option based on similar approach. Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jpolvino
Builder

I'll admit I don't fully understand your use case, but have you looked at this link? https://docs.splunk.com/Documentation/Splunk/7.1.0/Viz/PanelreferenceforSimplifiedXML

The solution may lie in the section labeled "condition (form input)". I use this logic a lot to set multiple tokens based upon conditions that match the input's label or value. Maybe you can use this to set tokens that have relative ranges?

Plus, did you try set token instead of eval token? See the link I provided for the syntax.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...