Dashboards & Visualizations

Best Way to Implement Logic in Dashboard Timeframe?

npapa
Explorer

Hello,
I have a dashboard built for a team that will be monitoring events from 6pm to 6am every day. Each panel refreshes every 10 minutes. We are running Splunk 6.5.3. Currently the timeframe set for the dashboard that the panels reference is

<input type="time" token="field1">
    <label></label>
    <default>
        <earliest>@d-6h</earliest>
        <latest>@d+6h</latest>
    </default>
</input>

This only shows what we want starting at midnight. For example: If I checked the dashboard at 3am on Tuesday I will see events starting at 6pm Monday up until 3am Tuesday which is good. But if I were to check the dashboard at 9pm Monday, I will instead see events from 6pm Sunday to 6am Monday.

Ideally I'd like to implement logic so that the dashboard "resets" at 6pm daily, and runs until 6am the next morning and have that repeat every evening. I could be overthinking this so I am open to any suggestions. Thank you!

0 Karma
1 Solution

aholzer
Motivator

I think what you want is:

earliest=+6h@d-6h
latest=+6h@d+6h

Logic:
If it's before 6pm adding 6 hours will still result it in being the same day, so applying @d will truncate to start of day, and then the -6h or +6h will set it correctly
If it's 6pm or later adding 6 hours will result in the day increasing by one, so when you apply the @d it will truncate to start of next day causing the "reset" you are looking for

Hope this helps

View solution in original post

aholzer
Motivator

I think what you want is:

earliest=+6h@d-6h
latest=+6h@d+6h

Logic:
If it's before 6pm adding 6 hours will still result it in being the same day, so applying @d will truncate to start of day, and then the -6h or +6h will set it correctly
If it's 6pm or later adding 6 hours will result in the day increasing by one, so when you apply the @d it will truncate to start of next day causing the "reset" you are looking for

Hope this helps

npapa
Explorer

Thanks! This seems to be what I was trying to accomplish.

0 Karma
Get Updates on the Splunk Community!

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...