I would like let a user use a timepicker to look at a problem period in a timechart and then I'd like to display another timechart below it with the same data but a week earlier for comparison. I can't put the data in the same timechart because there are too many metrics to display.
How can I make the bottom panel use an offset from the timepicker? I've tried to modify the XML like this:
<earliest>$tokenTIme.earliest$-7d</earliest>
<latest>$tokenTIme.latest$-7d</latest>
I've also tried to modify the search by doing something like this:
index=a source=b earliest=$tokenTIme.earliest$-7d latest=$tokenTIme.latest$-7d
Any ideas?
In the second panel, use the current timerange picker as earliest and latest, so that both panels are using same time range.
<earliest>$tokenTIme.earliest$</earliest>
<latest>$tokenTIme.latest$</latest>
Now, in the search of panel 2, we'll override the timerange from timerange picker values using a subsearch
index=a source=b [| gentimes start=-1 | addinfo | eval earliest=relative_time(info_min_time,"-7d") | eval latest=relative_time( info_max_time, "-7d") | table earliest latest | format "" "" "" "" "" "" ] |...rest of the search
The addinfo command in the subsearch will give value of current earliest and latest (from time range picker) as info_min_time and info_max_time respectively.
In the second panel, use the current timerange picker as earliest and latest, so that both panels are using same time range.
<earliest>$tokenTIme.earliest$</earliest>
<latest>$tokenTIme.latest$</latest>
Now, in the search of panel 2, we'll override the timerange from timerange picker values using a subsearch
index=a source=b [| gentimes start=-1 | addinfo | eval earliest=relative_time(info_min_time,"-7d") | eval latest=relative_time( info_max_time, "-7d") | table earliest latest | format "" "" "" "" "" "" ] |...rest of the search
The addinfo command in the subsearch will give value of current earliest and latest (from time range picker) as info_min_time and info_max_time respectively.
Wow, that's clever and worked perfectly! I've learned 2 new commands and an awesome technique. Thanks!