How to subtract date for a timechart panel from the selected time picker value on a dashboard

[jasoncorbett]

Hi,

I'm trying to create a dashboard with 2 panels and a time range picker. I want to be able to:
- Search a specific time period to display on Panel #1
- Compare the above to the same time period the previous week (so 1 week ago) using Panel #2

So panel #2 will display the exact same data and specific time but 1 week ago.

Errors:
1. The code below will work but only during the first time i run the dashboard
2. Everytime i choose a different time/date, it will gives different results (not 1 week ago)
3. Sometimes the panel will not refresh when a new date/time has been selected

Snippet below:

  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Current Time</label>
      <default>
        <earliest>1501034400</earliest>
        <latest>1501120800</latest>
      </default>
      <change>
        <eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
        <eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
      </change>
    </input>

        <title>Panel#1</title>
        <search>
          <query>`search string`</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>

<title>Panel#2</title>
        <search>
          <query>`search string`</query>
          <earliest>$earliest_offset$</earliest>
          <latest>$latest_offset$</latest>
        </search>

[jasoncorbett · Accepted solution]

I've found the answer to this question form another question i posted regarding the panels not updating. Thank you for your assistance in this.

Here: https://answers.splunk.com/answers/558256/panel-not-updating-when-changing-the-time-range-pi.html

[martin_mueller]

If you have this macro:

[shift_time(2)]
args = time,shift
definition = if("$time$"=="" OR "$time$"=="0", "0", if(match("$time$", "^\d+$$"), relative_time("$time$", "$shift$"), if("$time$"=="now", "\"$shift$\"", "\"$time$$shift$\"")))
iseval = 1

You can build a dashboard like this:

<form>
  <label>relativetime macro</label>
  <fieldset submitButton="false">
    <input type="time" token="time" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="offset" searchWhenChanged="true">
      <label>Vergleichszeitraum für den Schwellwert</label>
      <choice value="-h">Vor 1 Stunde</choice>
      <choice value="-d">Vor 1 Tag</choice>
      <choice value="-w">Vor 1 Woche</choice>
      <choice value="-4w">Vor 4 Wochen</choice>
      <choice value="-1mon">Vor 1 Monat</choice>
      <choice value="-52w">Vor 52 Wochen</choice>
      <choice value="-y">Vor 1 Jahr</choice>
      <default>-h</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal | timechart count
            | appendcols [search earliest=`shift_time($time.earliest$, $offset$)` latest=`shift_time($time.latest$, $offset$)` index=_internal | timechart count as comp]</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
        <option name="charting.chart.overlayFields">comp</option>
      </chart>
    </panel>
  </row>
</form>

(ignore the German-ness)

Your approach should work too if you use $earliest$ and $latest$ inside the eval elements, the time. prefixed ones are only set after the evals are done. That gives you each time range delayed by one instance.

[jasoncorbett]

Thanks Martin. I'll have a look further into the macro and see how it goes.

[HiroshiSatoh]

try this!

time range picker:time

Panel#1
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
Panel#2
          <earliest>$time.earliest$-1w@w</earliest>
          <latest>$time.earliest$</latest>

[jasoncorbett]

Thanks HiroshiSatoh. I tried this and the panel just shows Invalid Earliest Time

[HiroshiSatoh]

Which A will result in an error? It works properly in my environment.

[jasoncorbett]

Panel #2 was displaying the error. I've tried a few times and still the same error

[Sharon_Small]

I found I was also getting that error until I removed the white space e.g. $time.earliest$ - 1w@w will give the error while $time.earliest$-1w@w works correctly.