Dashboards & Visualizations

How to change the latest for the TimeRangePicker ?

ID_SplunkUser
Path Finder

Hi,

I'm using Time Range Picker in my dashboard. Whenever I select any particular time range, I want to increase the latest with 1 day.
i.e if selected latest is 10 Aug, then it should take it 11 Aug in the latest.
Earliest will be same.
Code:

<input type="time" searchWhenChanged="true" token="TIMEPICKER">
      <label>Date</label>

      <change>
         <set token="STARTDATEEPOCH">$earliest$</set>
        <set token="ENDDATEEPOCH">$latest$</set>
      </change>

    </input>

And I'm using the Time Range Picker selection as time range for Base query. I want the time range for Base query should be earliest & (latest+1day)

<search id="base">
    <query>index=hvpayments sourcetype=pq | eventstats count(ID) as Count by ID</query>
    <earliest>$STARTDATEEPOCH$</earliest>
    <latest>$ENDDATEEPOCH$</latest>
  </search>
0 Karma

sundareshr
Legend

Try this

index=xyz latest=[|gentimes start=-1 | eval search=relative_time(now(), "$timepicker.latest$")+86400 | fields search ]

ID_SplunkUser
Path Finder

I tried it... but it doesn't work the way I want it.

0 Karma

faizancool85
Path Finder

Hello,

You can achieve this by tweaking the required time range stanza in the times.conf file, which locates in etc/system/default.

Regards,
Faizan

0 Karma

ID_SplunkUser
Path Finder

Thanks for replying. But I don't want to change any configuration file. Is it possible to change within the Dashboard XML ?

0 Karma

rajeev_ku
Path Finder

Could you pls share the portion of XML so that can be tweaked?

0 Karma

ID_SplunkUser
Path Finder

I changed my question, and updated with the code.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...