Running Different Searches as per TIme Picker

[sdhawanx]

Hi All,

I have 2 different searches for a dashboard.

i want to run one search when the time range is Last seven days and the 2nd search when the time is any other value.

Any leads would be appreciated.

thanks in advance.

[ITWhisperer]

Set up one search with earliest -7d and latest now, and the other search to use a timepicker to provide a token with earliest and latest.

[sdhawanx]

I already have 2 searches, but only one time picker dropdown panel. I want to trigger search 1 when the time range is selected as Last 7 Days, and search 2 when other time range is selected. I am new to Splunk so i am having difficulty understanding how should I proceed. Should I trigger the searches using tokens or something like that ?

[ITWhisperer]

How different are your two searches from each other?

[sdhawanx]

1st search is a saved search and the 2nd one is normal search.

[ITWhisperer]

You could have two panels and use the depends attribute to hide/show each panel depending on the presence of a couple of tokens. You would set and unset these tokens in the timepicker depending on whether last 7 days is chosen or not.

[sdhawanx]

Yes I understand this, I am new to Splunk so can you help me with how to set these tokens