Dashboards & Visualizations

How can I use a token to update a graph?

mahbs
Path Finder

Hi,

I'm trying to implement a time picker. I've created a token for it. I was just wondering, how would I go about using the preset options to update my graph. I thought I could pass my token to a my query in the "earliest" and "latest" field and then somehow in the background it would find data for instance in the last 30 seconds.

This is my search query, please note, I have been able to get this filter to work for dropdowns wherein, you have a list of dates, a start date and end date is selected, and the graph is updated accordingly. I need to do the same thing using the time picker.

Search Query

  source="xxx" host="xxx" index="xxx" sourcetype="xxx" earliest=-0d@d latest=now | multikv | eval ReportKey="Today"| append [search index="test" sourcetype="csv" earliest=$source_tok$ latest=$End_Date$|multikv| eval ReportKey="CPU"]|timechart span=1m avg("CPU") by ReportKey

This is all I have at the moment for the timer panel:

<input type="time" token="tp_tock" searchWhenChanged="true">
      <label>Time Picker</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
0 Karma

DalJeanis
Legend

It's going to look something like this in your query string

 source="xxx" host="xxx" index="xxx" sourcetype="xxx"  earliest=$tp_tock.earliest$  latest=$tp_tock.latest$ | multikv...
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...