How to add a dynamic custom time input to dashboard?

[harishnpandey]

Hello All,

Currently, I have dashboard which has time input as "Today" which lists the total count of Payments

index=myindex "paymentmodule" | stats count as Payments

I can add another "Time Input -2" with same search which I used above for "Time Input-1"to existing dashboard but I don't know how to make the "Time input -2" dynamic so that I can compare the total counts for any weekday with current day.

For e.g. Total count for current week Wednesday v/s Total count for last week Wednesday

I could not find any option to make Time Range -2 dynamic so that I need not to go and manually change values in time picker

Appreciate your valuable suggestions in advance

Attached dashboard design

[niketn]

@harishnpandey, you can do this from the search done event handler it extracted the Job's earliest and latest time and calculates adjusted time as 7 days prior. However, this will work only if single day is selected from the first time picker.

          <done>
            <eval token="adjustedEarliest">relative_time(strptime($job.earliestTime$,"%Y/%m/%d %H:%M:%S"),"-7d")</eval>
            <eval token="adjustedLatest">relative_time(strptime($job.latestTime$,"%Y/%m/%d %H:%M:%S"),"-7d")</eval>
          </done>

Following is run any where example:

<form>
  <label>Dynamic Adjust time Last Week Same day</label>
  <fieldset submitButton="false">
    <input type="time" token="selTime">
      <label>Select Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Current Search</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="WARN"
| timechart count</query>
          <earliest>$selTime.earliest$</earliest>
          <latest>$selTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <eval token="adjustedEarliest">relative_time(strptime($job.earliestTime$,"%Y/%m/%d %H:%M:%S"),"-7d")</eval>
            <eval token="adjustedLatest">relative_time(strptime($job.latestTime$,"%Y/%m/%d %H:%M:%S"),"-7d")</eval>
          </done>
        </search>
        <option name="charting.chart">line</option>
      </chart>
      <chart>
        <title>Adjusted Search</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="WARN"
| timechart count</query>
          <earliest>$adjustedEarliest$</earliest>
          <latest>$adjustedLatest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
      </chart>
    </panel>
  </row>
</form>

If you are on Splunk 6.5, you should also explore the timewrap function for overlaying weekly data. For version prior to 6.5 check out appendcols command to have single query plot current day and last week same day data in a single chart.

Check out the following blog: https://www.splunk.com/blog/2012/02/19/compare-two-time-ranges-in-one-report/