Can I have 2 independent time controllers in one dashboard?

[HattrickNZ]

Can I have more than 2 time controllers in the 1 dashboard that are independent of each other?
So 1 time controller can control the timeframe on 1 chart and the 2nd time controller can control the timeframe of

This is the code for 1 but how do I make the other one?

  <input type="time" searchWhenChanged="true">
    <label>Timeframe</label>
    <default>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>
    </default>
  </input>
  ...
  <earliestTime>$earliest$</earliestTime>
  <latestTime>$latest$</latestTime>

[niketn · Accepted solution]

@HattrickNZ, yes you can surely use more than one time control in your dashboard (actually form in this case). You can distinguish between these using input tokens i.e. tokTime1 and tokTime2.

   <input type="time" token="tokTime1" searchWhenChanged="true">
     <label>Timeframe 1</label>
     <default>
       <earliestTime>-1d</earliestTime>
       <latestTime>now</latestTime>
     </default>
   </input>


   <input type="time" token="tokTime2" searchWhenChanged="true">
     <label>Timeframe 2</label>
     <default>
       <earliestTime>-1d</earliestTime>
       <latestTime>now</latestTime>
     </default>
   </input>

In fact you can place these inputs under specific XML Panel using drag and drop in Dashboard UI Editor or directly in XML by placing the input inside Panel ( <panel> ) before visualization tag starts.

PS: For using the time tokens inside your search you should use tags <earliest> and <latest>. The one in your example seems to be from Advanced XML which is deprecated.

   <earliest>$tokTime1.earliest$</earliest>
   <latest>$tokTime1.latest$</latest>

And

   <earliest>$tokTime2.earliest$</earliest>
   <latest>$tokTime2.latest$</latest>

Time tokens i.e. $tokTime1.earliest$ and $tokTime1.latest$ can also be used directly in your search query's base search i.e. in the first pipe inside Splunk query string.

<search>
    <query>index="_internal" sourcetype="splunkd" log_level!="INFO" earliest=$tokTime1.earliest$ latest=$tokTime1.latest$
| timechart count
    </query>
</search>

[HattrickNZ]

tks, that looks like a great answer.

[niketn]

Thanks, please try out and confirm whether your issue is resolved.