Dashboards & Visualizations

For a time input on a form, how do I match the "latest" field in the condition element?

patng323
Explorer

I have a form with this input:

<input type="time" token="time_tok">
  <label>Time Range</label>
  <default>
    <earliest>-60d@d</earliest>
    <latest>@d</latest>
  </default>
  <change>
    <condition value="now">
      <set token="time_tok.latest">@d</set>
    </condition>
  </change>    
</input>

What I want to do is that, whenever someone picks a time range where time_tok.latest is "now", I will force it back to @d (because our index won't contain today data). However, for time input, I don't know how to compare the latest part of the value. The above code doesn't work.

Does anyone know the right way?

  • Patrick
0 Karma

knielsen
Contributor

It seems you cannot overwrite time_tok.latest. If I try that, there is no change, I have to calculate the end time of the search into another field eg "latest", and use that field in the xml instead of "time_tok.latest".

I tried to abstract from only limiting to @d when latest=now, because it could also be that a user searches up to -1h@h or something. So I came up with some logic, but my problem with this is, that using eval within the dashboard seems to use my local time, instead of the server time. Since I am in UTC+2 and our server is on UTC, I end up not searching until 00:00 today, but 22:00 yesterday. But maybe this will help you to get a solution:

<input type="time" token="time_tok">
   <label>Time Range</label>
   <default>
     <earliest>-60d@d</earliest>
     <latest>@d</latest>
   </default>
   <change>
        <eval token="upto">case(isnum("$time_tok.latest$"), $time_tok.latest$, $time_tok.latest$="now", now(), 1=1, relative_time(now(), "$time_tok.latest$"))</eval>
        <eval token="today">relative_time(now(),"@d")</eval>
        <eval token="latest">if($upto$ > $today$, $today$, $upto$)</eval>
   </change>    
 </input>
...
<search>
<query> whatever</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$latest$</latest>
0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...