Dashboards & Visualizations

How to change the latest for the TimeRangePicker ?

ID_SplunkUser
Path Finder

Hi,

I'm using Time Range Picker in my dashboard. Whenever I select any particular time range, I want to increase the latest with 1 day.
i.e if selected latest is 10 Aug, then it should take it 11 Aug in the latest.
Earliest will be same.
Code:

<input type="time" searchWhenChanged="true" token="TIMEPICKER">
      <label>Date</label>

      <change>
         <set token="STARTDATEEPOCH">$earliest$</set>
        <set token="ENDDATEEPOCH">$latest$</set>
      </change>

    </input>

And I'm using the Time Range Picker selection as time range for Base query. I want the time range for Base query should be earliest & (latest+1day)

<search id="base">
    <query>index=hvpayments sourcetype=pq | eventstats count(ID) as Count by ID</query>
    <earliest>$STARTDATEEPOCH$</earliest>
    <latest>$ENDDATEEPOCH$</latest>
  </search>
0 Karma

sundareshr
Legend

Try this

index=xyz latest=[|gentimes start=-1 | eval search=relative_time(now(), "$timepicker.latest$")+86400 | fields search ]

ID_SplunkUser
Path Finder

I tried it... but it doesn't work the way I want it.

0 Karma

faizancool85
Path Finder

Hello,

You can achieve this by tweaking the required time range stanza in the times.conf file, which locates in etc/system/default.

Regards,
Faizan

0 Karma

ID_SplunkUser
Path Finder

Thanks for replying. But I don't want to change any configuration file. Is it possible to change within the Dashboard XML ?

0 Karma

rajeev_ku
Path Finder

Could you pls share the portion of XML so that can be tweaked?

0 Karma

ID_SplunkUser
Path Finder

I changed my question, and updated with the code.

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...