Dashboards & Visualizations

How to populate one time picker based on the selection of another time picker?

mnj1809
Path Finder

Hello,

I've a requirement to populate the "Time2" time picker to be updated automatically based on the selection of "Time1" time picker. The "Time2" time picker should be = Time1- 1 day. for example, if I choose Today in Time1 then Time2 should be automatically populated as "Last 1 day". If I choose Yesterday in Time1 then Time2 should be automatically populated as "Last 2 days" (starting from 12:00 AM day before yesterday till end of yesterday.)

mnj1809_0-1654202151115.png

@bowesmana 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

    <input type="time" token="timepicker" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
      <change>
        <condition>
          <eval token="earliestdaybefore">relative_time(relative_time(now(),$timepicker.earliest$),"-1d")</eval>
          <eval token="latestdaybefore">relative_time(relative_time(now(),$timepicker.latest$),"-1d")</eval>
        </condition>
      </change>
    </input>

View solution in original post

mnj1809
Path Finder

How can I achieve that using change handler of timer1? Please share the code so that I can understand.

@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

    <input type="time" token="timepicker" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
      <change>
        <condition>
          <eval token="earliestdaybefore">relative_time(relative_time(now(),$timepicker.earliest$),"-1d")</eval>
          <eval token="latestdaybefore">relative_time(relative_time(now(),$timepicker.latest$),"-1d")</eval>
        </condition>
      </change>
    </input>

mnj1809
Path Finder

Thanks mate. It helped me.

@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you need a second pair of earliest and latest tokens, why not create this in the change handler of timer1?

0 Karma

mnj1809
Path Finder

Hello,

I tried to set a default time on page load but I am getting below error:

mnj1809_0-1654427601710.png

 

Dashboard XML:

<form>
<label>Display Time Picker</label>
<init>
<set token="earliestdaybefore">-1d@d</set>
<set token="latestdaybefore">@d</set>
</init>
<fieldset submitButton="false">
<input type="time" token="time" searchWhenChanged="true">
<label>HVA Timeframe</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
<change>
<condition>
<eval token="earliestdaybefore">relative_time(relative_time(now(),$time.earliest$),"-1d")</eval>
<eval token="latestdaybefore">relative_time(relative_time(now(),$time.latest$),"-1d")</eval>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<title>Previous Dates</title>
<table>
<search>
<query>| makeresults
| eval earliestdaybefore= $earliestdaybefore$,
latestdaybefore=$latestdaybefore$
| eval earliest_time=strftime(earliestdaybefore,"%Y-%m-%dT%H:%M:%S"),
latest_time=strftime(latestdaybefore,"%Y-%m-%dT%H:%M:%S")
| table earliest_time, latest_time, earliestdaybefore, latestdaybefore
| fields - _time</query>
<earliest>$earliestdaybefore$</earliest>
<latest>$latestdaybefore$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>

@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Change the token initialisation

<init>
<eval token="earliestdaybefore">relative_time(now(),"-1d@d")</eval>
<eval token="latestdaybefore">relative_time(now(),"@d")</eval>
</init>
0 Karma

mnj1809
Path Finder

Thanks, It works 🙂
@ITWhisperer 

0 Karma

mnj1809
Path Finder

Hello,

The solution you provided to me is working well over my local environment (time zone is IST). I am successfully able to get the previous date wrt what is selected in the time picker.

mnj1809_4-1654455709561.png

 

But over my production environment (time zone is EST), it's not showing me the correct timestamp.

mnj1809_5-1654456256036.png

Please suggest.

@ITWhisperer 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...