I have a single value dashboard panel that counts the number of hosts by IP address. I am listing the time range of the search in the title of the panel using $earliest_d$
and $latest_d$
tokens. For some unknown reason, only $latest_d$
is working and displaying the end time of the search. I am going in circles trying to figure out why the earliest time field isn't loading as expected.
<form>
<label>Test</label>
<fieldset submitButton="false" autoRun="true"></fieldset>
<row>
<panel>
<title>Unique Devices</title>
<single>
<title>$earliest_d$ - $latest_d$</title>
<search>
<done>
<eval token="earliest_d">strftime(relative_time(now(), $job.request.earliest_time$), "%d %b %T")</eval>
<eval token="latest_d">strftime(relative_time(now(), $job.request.latest_time$), "%d %b %T")</eval>
</done>
<query>| tstats dc(host) AS Hosts where (index=a* OR index=b*)</query>
<earliest>-d@d</earliest>
<latest>@d</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="drilldown">none</option>
<option name="numberPrecision">0</option>
<option name="rangeColors">["0x65a637","0x65a637"]</option>
<option name="rangeValues">[0]</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="underLabel">Unique Hosts</option>
<option name="unitPosition">after</option>
<option name="useColors">1</option>
<option name="useThousandSeparators">1</option>
</single>
</panel>
</row>
</form>
Change <earliest>-d@d</earliest>
to <earliest>-1d@d</earliest>
, this worked for me.
Change <earliest>-d@d</earliest>
to <earliest>-1d@d</earliest>
, this worked for me.
Why it wouldn't work with -d vs -1d is a mystery. Thank you, this worked perfectly, thank you!