Using Time Picker Tokens in Other Search Time

[dsitek]

I am trying to create a dashboard in which the results of one query can be compared to the results of the same query from 24 hours prior. Due to the volume of events that my search generates, it is best to keep the timeframe restricted to 15 minutes (or similar short spans). Is there a way to use the time tokens of one search to set the timeframe for the search for the day prior e.g. from 2:00 to 2:15 on 7/11/19 as compared to 2:00 to 2:15 on 7/10/19?
I have tried using the default tokens of $time1.earliest$ and $time1.latest$ in another searches time quantifiers, but $time1.earliest$-24h and $time1.latest$-24h gives an error, saying that the latest time can not be before earlier time.

[niketn · Accepted solution]

@dsitek refer to one of my older answer with two approaches to get the epoch earliest and latest time from Time Picker using either independent search or <eval>. Whichever approach you use you can subtract 86400 to get epoch time with -24h

https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html

Let us know if you need further assistance.

[dsitek]

@niketnilay I was able to use your solution to convert the time tokens into epochs so that I could use them in my second search and run it a single day prior to the first search. Thank you so much.
For those who do not wish to read the full solution, I added the following search to the top of my dashboard:
`Access Logs Test

<query>| makeresults
 </query>
<earliest>$time1.earliest$</earliest>
<latest>$time1.latest$</latest>
<done>
  <eval token="tokEarliestTime1">strptime($job.earliestTime$,"%Y/%m/%d %H:%M:%S %p")</eval>
  <eval token="tokLatestTime1">strptime($job.latestTime$,"%Y/%m/%d %H:%M:%S %p")</eval>
  <eval token="tokEarliestTime2">tokEarliestTime1-86400</eval>
  <eval token="tokLatestTime2">tokLatestTime1-86400</eval>
</done>`

I then used the tokens tokEarliestTime2 and tokLatestTime2 as the time tokens for my second search.

[niketn]

Glad it worked for you! Have an awesome weekend ahead!

[dsitek]

You as well!