Dashboards & Visualizations

How to initialize a time token earliest during dashboard refresh?

MadhuAgineati
Loves-to-Learn Lots

hi ,

i did some modifications to the time token earliest and latest as per my requirement as shown below.

<input type="time" token="time_picker" searchWhenChanged="true">
<label>Time Picker</label>
<change>
<eval token="my_earliest">if(isnum($time_picker.earliest$),$time_picker.earliest$,relative_time(now(),$time_picker.earliest$))</eval>
<eval token="my_latest">if(isnum($time_picker.latest$),$time_picker.latest$,relative_time(now(),$time_picker.latest$))</eval>
<eval token="my_now">now()</eval>
<eval token="final_earliest">strftime($my_earliest$,"%m/%d/%Y:%H:%M:%S")</eval>
<eval token="modified_axs">if($my_latest$==$my_now$,$my_latest$-60,$my_latest$)</eval>
<eval token="modified_prex">if($my_latest$==$my_now$,$my_latest$,$my_latest$+60)</eval>
<eval token="final_latest_axs">strftime(modified_axs,"%m/%d/%Y:%H:%M:%S")</eval>
<eval token="final_latest_prex">strftime(modified_prex,"%m/%d/%Y:%H:%M:%S")</eval>
</change>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>

Now, when i refresh the dashboard i am getting  the error , it is not picking the default earliest. it is taking time_picker.earliest as now(). i want to set it for -15m during dashboard refresh 

Error in 'search' command: Unable to parse the search: Invalid time bounds in search: start=1652905253 > end=1652905193.

how can i solve this issue ? @niketn 

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...