Dashboards & Visualizations

How can I use a token to update a graph?

mahbs
Path Finder

Hi,

I'm trying to implement a time picker. I've created a token for it. I was just wondering, how would I go about using the preset options to update my graph. I thought I could pass my token to a my query in the "earliest" and "latest" field and then somehow in the background it would find data for instance in the last 30 seconds.

This is my search query, please note, I have been able to get this filter to work for dropdowns wherein, you have a list of dates, a start date and end date is selected, and the graph is updated accordingly. I need to do the same thing using the time picker.

Search Query

  source="xxx" host="xxx" index="xxx" sourcetype="xxx" earliest=-0d@d latest=now | multikv | eval ReportKey="Today"| append [search index="test" sourcetype="csv" earliest=$source_tok$ latest=$End_Date$|multikv| eval ReportKey="CPU"]|timechart span=1m avg("CPU") by ReportKey

This is all I have at the moment for the timer panel:

<input type="time" token="tp_tock" searchWhenChanged="true">
      <label>Time Picker</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
0 Karma

DalJeanis
Legend

It's going to look something like this in your query string

 source="xxx" host="xxx" index="xxx" sourcetype="xxx"  earliest=$tp_tock.earliest$  latest=$tp_tock.latest$ | multikv...
0 Karma
Get Updates on the Splunk Community!

Alpha Launch: AI-Assisted Auto-Schematization for CIM

Streamlining Data Onboarding: Announcing the Alpha Release of AI-Assisted Auto-Schematization For many Splunk ...

Enterprise Security(ES) Essentials or Premier? Let's discuss Splunk ES Editions on ...

  Hi everyone, Last year at .conf25, we shared something exciting: Splunk Enterprise Security is evolving ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 5

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...