Dashboards & Visualizations

How to populate one time picker based on the selection of another time picker?

mnj1809
Path Finder

Hello,

I've a requirement to populate the "Time2" time picker to be updated automatically based on the selection of "Time1" time picker. The "Time2" time picker should be = Time1- 1 day. for example, if I choose Today in Time1 then Time2 should be automatically populated as "Last 1 day". If I choose Yesterday in Time1 then Time2 should be automatically populated as "Last 2 days" (starting from 12:00 AM day before yesterday till end of yesterday.)

mnj1809_0-1654202151115.png

@bowesmana 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

    <input type="time" token="timepicker" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
      <change>
        <condition>
          <eval token="earliestdaybefore">relative_time(relative_time(now(),$timepicker.earliest$),"-1d")</eval>
          <eval token="latestdaybefore">relative_time(relative_time(now(),$timepicker.latest$),"-1d")</eval>
        </condition>
      </change>
    </input>

View solution in original post

mnj1809
Path Finder

How can I achieve that using change handler of timer1? Please share the code so that I can understand.

@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

    <input type="time" token="timepicker" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
      <change>
        <condition>
          <eval token="earliestdaybefore">relative_time(relative_time(now(),$timepicker.earliest$),"-1d")</eval>
          <eval token="latestdaybefore">relative_time(relative_time(now(),$timepicker.latest$),"-1d")</eval>
        </condition>
      </change>
    </input>

mnj1809
Path Finder

Thanks mate. It helped me.

@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you need a second pair of earliest and latest tokens, why not create this in the change handler of timer1?

0 Karma

mnj1809
Path Finder

Hello,

I tried to set a default time on page load but I am getting below error:

mnj1809_0-1654427601710.png

 

Dashboard XML:

<form>
<label>Display Time Picker</label>
<init>
<set token="earliestdaybefore">-1d@d</set>
<set token="latestdaybefore">@d</set>
</init>
<fieldset submitButton="false">
<input type="time" token="time" searchWhenChanged="true">
<label>HVA Timeframe</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
<change>
<condition>
<eval token="earliestdaybefore">relative_time(relative_time(now(),$time.earliest$),"-1d")</eval>
<eval token="latestdaybefore">relative_time(relative_time(now(),$time.latest$),"-1d")</eval>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<title>Previous Dates</title>
<table>
<search>
<query>| makeresults
| eval earliestdaybefore= $earliestdaybefore$,
latestdaybefore=$latestdaybefore$
| eval earliest_time=strftime(earliestdaybefore,"%Y-%m-%dT%H:%M:%S"),
latest_time=strftime(latestdaybefore,"%Y-%m-%dT%H:%M:%S")
| table earliest_time, latest_time, earliestdaybefore, latestdaybefore
| fields - _time</query>
<earliest>$earliestdaybefore$</earliest>
<latest>$latestdaybefore$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>

@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Change the token initialisation

<init>
<eval token="earliestdaybefore">relative_time(now(),"-1d@d")</eval>
<eval token="latestdaybefore">relative_time(now(),"@d")</eval>
</init>
0 Karma

mnj1809
Path Finder

Thanks, It works 🙂
@ITWhisperer 

0 Karma

mnj1809
Path Finder

Hello,

The solution you provided to me is working well over my local environment (time zone is IST). I am successfully able to get the previous date wrt what is selected in the time picker.

mnj1809_4-1654455709561.png

 

But over my production environment (time zone is EST), it's not showing me the correct timestamp.

mnj1809_5-1654456256036.png

Please suggest.

@ITWhisperer 

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...