Picking wrong Time Range(-7d@h instead of -7d@d) due to which data is decreasing

[aditsss]

Hi Everyone,

I have one dashboard which consists of two Panels Failure and Failure Trend.

I have one date range Indicator for which I have set Earliest time as -7d@d and latest time as @d.

The Issue I am facing is when I load my dashboard for the first its taking the correct time (Earliest time as -7d@d and latest time as @d) and showing the data accordingly.

But when I select some other presets say "Yesterday" and then again selecting last 7 days its picking time range as  Earliest Time -7d@h and latest time as now due to which my data  is decreasing.

Can someone guide me on that.

Below is my XML Code:

<input type="time" token="field1" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-7d@d</earliest>
<latest>@d</latest>
</default>
</input>

<panel>
<chart>
<title>FAILURE TREND</title>
<search>
<query>index="ABC" sourcetype=XYZ FAILURE $OrgName$ | bin span=1d _time |stats count by _time</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>

<panel>
<single>
<title>FAILURE</title>
<search>
<query>index="ABC" sourcetype=XYZ FAILURE $OrgName$ | bin span=1d _time
| stats count by _time
| eventstats first(_time) as firsttime last(_time) as lasttime
| where _time = firsttime OR _time = lasttime
| fields _time count
</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">trend</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="trendDisplayMode">percent</option>
<option name="unit"></option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option>
<option name="trendColorInterpretation">inverse</option>
<option name="useColors">1</option>
<option name="showSparkline">1</option>
<option name="trendDisplayMode">percent</option>
</single>
</panel>

[Nisha18789 · Accepted solution]

Hi @aditsss , when you select last 7 days from the Presets options that actually mean timeframe between -7d@h to now.  That's how its defined in the time range settings. So it does not matter if you click on the Last 7 days after click on any other time selection. Its just how Last 7 days behaves (its relative time wrt current time)

Please see attached screenshot for reference.

Hope this helps!

[richgalloway]

"Last 7 days" is defined in times.conf as "-7d@h".  Times.conf is the file that governs what is in the time picker.  Perhaps you can get your admin to add an entry to the file, perhaps called "Week Ago Today", for "-7d@d".