Dashboards & Visualizations

How to change the latest for the TimeRangePicker ?

ID_SplunkUser
Path Finder

Hi,

I'm using Time Range Picker in my dashboard. Whenever I select any particular time range, I want to increase the latest with 1 day.
i.e if selected latest is 10 Aug, then it should take it 11 Aug in the latest.
Earliest will be same.
Code:

<input type="time" searchWhenChanged="true" token="TIMEPICKER">
      <label>Date</label>

      <change>
         <set token="STARTDATEEPOCH">$earliest$</set>
        <set token="ENDDATEEPOCH">$latest$</set>
      </change>

    </input>

And I'm using the Time Range Picker selection as time range for Base query. I want the time range for Base query should be earliest & (latest+1day)

<search id="base">
    <query>index=hvpayments sourcetype=pq | eventstats count(ID) as Count by ID</query>
    <earliest>$STARTDATEEPOCH$</earliest>
    <latest>$ENDDATEEPOCH$</latest>
  </search>
0 Karma

sundareshr
Legend

Try this

index=xyz latest=[|gentimes start=-1 | eval search=relative_time(now(), "$timepicker.latest$")+86400 | fields search ]

ID_SplunkUser
Path Finder

I tried it... but it doesn't work the way I want it.

0 Karma

faizancool85
Path Finder

Hello,

You can achieve this by tweaking the required time range stanza in the times.conf file, which locates in etc/system/default.

Regards,
Faizan

0 Karma

ID_SplunkUser
Path Finder

Thanks for replying. But I don't want to change any configuration file. Is it possible to change within the Dashboard XML ?

0 Karma

rajeev_ku
Path Finder

Could you pls share the portion of XML so that can be tweaked?

0 Karma

ID_SplunkUser
Path Finder

I changed my question, and updated with the code.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...