Dashboards & Visualizations

How to initialize a time token earliest during dashboard refresh?

Loves-to-Learn Lots

hi ,

i did some modifications to the time token earliest and latest as per my requirement as shown below.

<input type="time" token="time_picker" searchWhenChanged="true">
<label>Time Picker</label>
<eval token="my_earliest">if(isnum($time_picker.earliest$),$time_picker.earliest$,relative_time(now(),$time_picker.earliest$))</eval>
<eval token="my_latest">if(isnum($time_picker.latest$),$time_picker.latest$,relative_time(now(),$time_picker.latest$))</eval>
<eval token="my_now">now()</eval>
<eval token="final_earliest">strftime($my_earliest$,"%m/%d/%Y:%H:%M:%S")</eval>
<eval token="modified_axs">if($my_latest$==$my_now$,$my_latest$-60,$my_latest$)</eval>
<eval token="modified_prex">if($my_latest$==$my_now$,$my_latest$,$my_latest$+60)</eval>
<eval token="final_latest_axs">strftime(modified_axs,"%m/%d/%Y:%H:%M:%S")</eval>
<eval token="final_latest_prex">strftime(modified_prex,"%m/%d/%Y:%H:%M:%S")</eval>

Now, when i refresh the dashboard i am getting  the error , it is not picking the default earliest. it is taking time_picker.earliest as now(). i want to set it for -15m during dashboard refresh 

Error in 'search' command: Unable to parse the search: Invalid time bounds in search: start=1652905253 > end=1652905193.

how can i solve this issue ? @niketnilay 

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...