Subtract time from time picker token response

[jeffreyleavy]

So I have a "complex search" on a dashboard with a search and a subsearch. I currently have two time pickers on said dashboard, but would like only one. The main search is looking at timepicker1 via token1, and the subsearch is looking at timepicker2 via token2. What I want to do is have the subsearch look at token1 and take 7 days off, so I can do a comparison. so "selectedtime-7d". Is something like this possible. I have done quite a bit of tinkering with no success.

EX: index=logs appname=web earliest=$token1.earliest$ latest=$token1.latest$ | appendcols [search index=logs appname=web earliest=$token2.earliest$ latest=$token2.latest$]

In theory for the subsearch I would like it to be something like [search index=logs appname=web earliest=($token1.earliest$-7d) latest=($token1.latest$-7d) ]

Any way to make this happen?

[martin_mueller]

I believe you're looking for this.

https://answers.splunk.com/answers/558071/how-to-subtract-date-for-a-timechart-panel-from-th.html#an...

[paulbannister]

HI There

One thing you could try is adding a base search to the dashboard who's sole purpose is to generate these secondary time tokens for you using makeresults, then pull the tokens from this to use in the other search

|makeresults
|eval new_earliest=$token1.earliest$-604800, new_latest=$token1.latest$-604800

A little crude but should do the job

[jeffreyleavy]

How would I go about doing that? I have never used makeresults before, and this is my first time with tokens as well.