Dashboards & Visualizations

How can I use a token to update a graph?

mahbs
Path Finder

Hi,

I'm trying to implement a time picker. I've created a token for it. I was just wondering, how would I go about using the preset options to update my graph. I thought I could pass my token to a my query in the "earliest" and "latest" field and then somehow in the background it would find data for instance in the last 30 seconds.

This is my search query, please note, I have been able to get this filter to work for dropdowns wherein, you have a list of dates, a start date and end date is selected, and the graph is updated accordingly. I need to do the same thing using the time picker.

Search Query

  source="xxx" host="xxx" index="xxx" sourcetype="xxx" earliest=-0d@d latest=now | multikv | eval ReportKey="Today"| append [search index="test" sourcetype="csv" earliest=$source_tok$ latest=$End_Date$|multikv| eval ReportKey="CPU"]|timechart span=1m avg("CPU") by ReportKey

This is all I have at the moment for the timer panel:

<input type="time" token="tp_tock" searchWhenChanged="true">
      <label>Time Picker</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
0 Karma

DalJeanis
Legend

It's going to look something like this in your query string

 source="xxx" host="xxx" index="xxx" sourcetype="xxx"  earliest=$tp_tock.earliest$  latest=$tp_tock.latest$ | multikv...
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...