Dashboards & Visualizations

Set Custom TimeRange picker on Specific Splunk Studio Dashboard

viku7474
Explorer

I want to customize the Splunk studio dashboard in such a way that it shows last 7 days (each day) separately.  The requirement is only one dashboard. not globally. 

Today's date is 2nd May 2024. Now I want to showcase historical day here for last 7 days separately.
I want options like below in the presets so that if they select that day then users would see that day's data.
The historical dates should change dynamically.

1st May
31st April
30th April
29th April
28th April
27th April
26th April

viku7474_0-1714638343700.png

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Set your dropdown to this dynamic data source

| makeresults
| eval day=mvrange(0,7)
| mvexpand day
| eval day=relative_time(now(),"@d-".(1+day)."d")
| eval suffix=tonumber(trim(strftime(day, "%e")))
| eval suffix=case(suffix%10 == 1, "st", suffix%10 == 2, "nd", suffix%10 == 3, "rd", true(), "th")
| eval day=strftime(day,"%e").suffix." ".strftime(day,"%B")
| table day

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Set your dropdown to this dynamic data source

| makeresults
| eval day=mvrange(0,7)
| mvexpand day
| eval day=relative_time(now(),"@d-".(1+day)."d")
| eval suffix=tonumber(trim(strftime(day, "%e")))
| eval suffix=case(suffix%10 == 1, "st", suffix%10 == 2, "nd", suffix%10 == 3, "rd", true(), "th")
| eval day=strftime(day,"%e").suffix." ".strftime(day,"%B")
| table day

viku7474
Explorer

This is exactly what I was looking for.
but is it possible to incorporate along with the existing Time Range Picker?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you mean to change the standard timepicker to include your special options into a modified timepicker, try adding new timeranges: Time ranges are configured in Settings -> Knowledge -> User interface -> Time ranges section of the Splunk interface.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In June, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...

Index This | What gets bigger the more you remove?

June 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...