Dashboards & Visualizations

How to use 10 different time ranges in Dashboard Studio

alexis
Explorer

Hi everyone,

There are 10 single value graphs on my Dashboard. I don't want to use global time Range. How can I add for each?

Labels (2)
0 Karma
1 Solution

Stefanie
Builder

In Dashboard Studio, you can specify this by directly modifying the Source. 

Once you create your graphs, in the source you can add a stanza for queryParameters and then specify the earliest and latest for your your search.

The earliest and latest are Time Modifiers as specified in https://docs.splunk.com/Documentation/SCS/current/Search/Timemodifiers

and also https://docs.splunk.com/Documentation/SCS/current/Search/Specifyrelativetime 

 

Here's an example. This is a line graph that pulls the count by index for the past two hours up until now.

 
"visualizations": {
		"viz_chart_1": {
			"type": "viz.line",
			"options": {
				"drilldown": "none",
				"refresh.display": "progressbar"
			},
			"dataSources": {
				"primary": "ds_search_1"
			}
		},
"dataSources": {
		"ds_search_1": {
			"type": "ds.search",
			"options": {
				"query": "|tstats count by index",
				"queryParameters": {
					"earliest": "-2h@h",
					"latest": "now"
				}
			}
		},

 

View solution in original post

alexis
Explorer

Thanks a lot . Stefanie

Stefanie
Builder

In Dashboard Studio, you can specify this by directly modifying the Source. 

Once you create your graphs, in the source you can add a stanza for queryParameters and then specify the earliest and latest for your your search.

The earliest and latest are Time Modifiers as specified in https://docs.splunk.com/Documentation/SCS/current/Search/Timemodifiers

and also https://docs.splunk.com/Documentation/SCS/current/Search/Specifyrelativetime 

 

Here's an example. This is a line graph that pulls the count by index for the past two hours up until now.

 
"visualizations": {
		"viz_chart_1": {
			"type": "viz.line",
			"options": {
				"drilldown": "none",
				"refresh.display": "progressbar"
			},
			"dataSources": {
				"primary": "ds_search_1"
			}
		},
"dataSources": {
		"ds_search_1": {
			"type": "ds.search",
			"options": {
				"query": "|tstats count by index",
				"queryParameters": {
					"earliest": "-2h@h",
					"latest": "now"
				}
			}
		},

 

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...