Dashboards & Visualizations

Advanced Time Picker not returning correct value

hawifaris
Loves-to-Learn

I have set a default custom time to between last week and this week Thursday, however the latest time is not being reflected correctly in the token myTimepickerUnixLatest. Instead, the myTimepickerUnixLatest token ends up being the exact same as myTimepickerUnixEarliest. I am not sure where I am going wrong, I believe the fault is lying in relative_time(now(),'latest').

<input type="time" token="time">
  <label></label>
  <default>
    <earliest>@w4</earliest>
    <latest>+1w@w4</latest>
  </default>
  <change>
    <eval token="myTimepickerUnixEarliest">if(isnum('earliest'),'earliest',relative_time(now(),'earliest'))</eval>
    <eval token="myTimepickerUnixLatest">if(isnum('latest'),'latest',relative_time(now(),'latest'))</eval>
    <eval token="myTimepickerEarliest">strftime(myTimepickerUnixEarliest, "%B %d %Y %H:%M:%S")</eval>
    <eval token="myTimepickerLatest">strftime(myTimepickerUnixLatest, "%B %d %Y %H:%M:%S")</eval>
  </change>
</input>
0 Karma

niketn
Legend

@hawifaris please refer to one of my older answer to achieve this using independent search as a workaround since earliest and latest token do not work as expected: https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html

There are two option based on similar approach. Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jpolvino
Builder

I'll admit I don't fully understand your use case, but have you looked at this link? https://docs.splunk.com/Documentation/Splunk/7.1.0/Viz/PanelreferenceforSimplifiedXML

The solution may lie in the section labeled "condition (form input)". I use this logic a lot to set multiple tokens based upon conditions that match the input's label or value. Maybe you can use this to set tokens that have relative ranges?

Plus, did you try set token instead of eval token? See the link I provided for the syntax.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...