Dashboards & Visualizations

How can I get the earliest and latest values from the time range field and calculate the difference between them?

Explorer

Hi, Splunk comunity!

I have a dashboard with advanced time parameters in time range form where i set earliest and latest values.

How can i get earliest and latest values in my search query, calculate the difference between them and multiply to coefficient?

In the result, I want something like this:

 | eval k = (latest-earliest)*coefficient
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi @mishaaaaaaaaaa

You can use the tokens directly in your search if you want, or alternatively you can use the the |addinfo command in your search.

Here is some info: https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Addinfo

Hope this helps

View solution in original post

SplunkTrust
SplunkTrust

Hi @mishaaaaaaaaaa

You can use the tokens directly in your search if you want, or alternatively you can use the the |addinfo command in your search.

Here is some info: https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Addinfo

Hope this helps

View solution in original post

Explorer

thanks a lot!
I solved my problem!

0 Karma