Dashboards & Visualizations

How to change the latest for the TimeRangePicker ?

ID_SplunkUser
Path Finder

Hi,

I'm using Time Range Picker in my dashboard. Whenever I select any particular time range, I want to increase the latest with 1 day.
i.e if selected latest is 10 Aug, then it should take it 11 Aug in the latest.
Earliest will be same.
Code:

<input type="time" searchWhenChanged="true" token="TIMEPICKER">
      <label>Date</label>

      <change>
         <set token="STARTDATEEPOCH">$earliest$</set>
        <set token="ENDDATEEPOCH">$latest$</set>
      </change>

    </input>

And I'm using the Time Range Picker selection as time range for Base query. I want the time range for Base query should be earliest & (latest+1day)

<search id="base">
    <query>index=hvpayments sourcetype=pq | eventstats count(ID) as Count by ID</query>
    <earliest>$STARTDATEEPOCH$</earliest>
    <latest>$ENDDATEEPOCH$</latest>
  </search>
0 Karma

sundareshr
Legend

Try this

index=xyz latest=[|gentimes start=-1 | eval search=relative_time(now(), "$timepicker.latest$")+86400 | fields search ]

ID_SplunkUser
Path Finder

I tried it... but it doesn't work the way I want it.

0 Karma

faizancool85
Path Finder

Hello,

You can achieve this by tweaking the required time range stanza in the times.conf file, which locates in etc/system/default.

Regards,
Faizan

0 Karma

ID_SplunkUser
Path Finder

Thanks for replying. But I don't want to change any configuration file. Is it possible to change within the Dashboard XML ?

0 Karma

rajeev_ku
Path Finder

Could you pls share the portion of XML so that can be tweaked?

0 Karma

ID_SplunkUser
Path Finder

I changed my question, and updated with the code.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...