Dashboards & Visualizations

How to use 2 timepickers in splunk dashboard query

sngs0849
New Member

I have a dashboard query where I am comparing some stats between 2 different dates. I am able to use one time picker but not sure how to remove - (earliest=1587963600 latest=1588050000) and take it as a paramerter from timepicker.

 source=table1 (earliest=1587963600 latest=1588050000)
    | JOIN type=inner id 
    [ SEARCH source=table1  
    | rename user_id AS id ] </query>
              <earliest>$currentStatus.earliest$</earliest>
              <latest>$currentStatus.latest$</latest>
            </search>
0 Karma

to4kawa
Ultra Champion
<query>source=table1 | rename user_id AS id | eval flag="current"
| append [ search source=table1 (earliest=1587963600 latest=1588050000) 
| eval flag="before" ]
| stats AsYouLike by id </query>

I don't have accurate information, so this is about it.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...