We've got a status panel on a custom dashboard with a single value that displays the count of a field containing an error code. The view is refreshed every minute, so a running total of the error code is displayed. That all works fine. What we would like to do is add a button, like a submit button, that when pressed would modify the earliest parameter of the search to use a current time, essentially resetting the count to zero.
earliest=$st$ | stats count AS errs
Right now my $st$ parameter is hardcoded to a start time, but I'd like some action (like pressing the button) to modify that parameter with a new time.
Is dynamically resetting the earliest value even possible, or is there maybe some other way to reset the count?
The subsearch isn't really a search at all, but just a little trick to get an "earliest=1231421" searchterm out to the main search, such that the value will always be set to the current time when the search is dispatched.