I have a Time input field in my dashboard. How do I retrieve the no of hours chosen by the user from the time input fields' earliest and latest.
Say the user select Last 4 hours. Then my span should be displayed as 4. Or if he selects timerange where the difference is 4.5 hours, I need to calculate the span as 4.5 hours from the earliest and latest of time input token.
Could someone help me out here.
@sangs8788,
You can calculate timerange in hours with below query.
| stats count | addinfo | eval diff=round((info_max_time-info_min_time)/3600,1)
Here diff
is time difference in hours.
Hi @sangs8788,
The tokens for earliest and latest generated by the time picker are as follows (this is straight from the docs) :
If you have a form with panels that use different time pickers, use tokens for the time input to indicate the time picker to use for each panel. To access the earliest and latest values from a time picker, use the following modifiers to the token:
$timer_tok.earliest$
$timer_tok.latest$
A time input that does not define a token is global. The values selected from such a time picker applies to all visualizations that do not otherwise specify a time picker.
You can find more details and examples here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/tokens#Time_input_example
Hope that helps.
@sangs8788,
You can calculate timerange in hours with below query.
| stats count | addinfo | eval diff=round((info_max_time-info_min_time)/3600,1)
Here diff
is time difference in hours.
Thanks this works. But curious. Lets say I am setting
eval count_limit=diff*20 | search count >count_limit
When I add above part to the query, It doesnt result anything or doesnt consider the condition. What is it I am doing wrong in here ? Could you please help me out here
search
command does not support >
. Use where
instead.
Thx. It works