Dashboards & Visualizations

Dashboard with different time tokens (today and -7days)

auaave
Communicator

Hi guys,

I have a daily report dashboard with the below token. However, I need to create another report on the same dashboard with trend for the last - 7 days.

How do I create a new token for the last 7 days?

If "today" is selected on the time picker, It should search for - 7 days from today?
If "yesterday" is selected on the time picker, It should search for - 7 days from yesterday?

<input type="time" token="time" searchWhenChanged="true">
      <label>Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
      <change>
        <eval token="time.earliest_epoch">if('earliest'="",0,if(isnum('earliest'),'earliest',relative_time(now(),'earliest')))</eval>
        <eval token="time.latest_epoch">if(isnum('latest'),'latest',relative_time(now(),'latest'))</eval>
        </change>
    </input>

Thank you!

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...