Okay @datachacha
Ive been having a good think about this and I dont think I have an elegant solution - but I think I do have *a* solution:
This uses a hidden token/text box to the side and a search to determine the _time+2hours.
You can then use this in your other queries as earliest/latest as per the sample event on the dashboard using `$globalTimeSpl:results.earliest$` and `$globalTimeSpl:results.latest$`
Here is the full JSON to have a play around with - does this do what you need?
{
"title": "testing",
"description": "",
"inputs": {
"input_MPUmpGoR": {
"options": {
"defaultValue": "DEFAULT",
"token": "calc_earliest"
},
"title": "Earliest",
"type": "input.text"
},
"input_zIorjrMc": {
"options": {
"defaultValue": "-24h@h,now",
"token": "tr_global"
},
"title": "Main Time Selector",
"type": "input.timerange"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
}
}
}
},
"visualizations": {
"viz_BcDlqy4I": {
"options": {
"markdown": "Earliest = $globalTimeSpl:result.earliest$ \nLatest = $globalTimeSpl:result.latest$"
},
"type": "splunk.markdown"
},
"viz_NgmH6lHI": {
"dataSources": {
"primary": "ds_BlYVOfBA"
},
"title": "This shows for time selected + 2hours",
"type": "splunk.table"
},
"viz_Nqdf4h2p": {
"dataSources": {
"primary": "ds_ccCiW2S8"
},
"eventHandlers": [
{
"options": {
"tokens": [
{
"key": "row._time.value",
"token": "calc_earliest"
}
]
},
"type": "drilldown.setToken"
}
],
"type": "splunk.column"
},
"viz_zUx2Zt29": {
"dataSources": {
"primary": "ds_ZKBDXZy2_ds_BlYVOfBA"
},
"type": "splunk.table"
}
},
"dataSources": {
"ds_BlYVOfBA": {
"name": "global",
"options": {
"query": "index=_internal earliest=$globalTimeSpl:result.earliest$ latest=$globalTimeSpl:result.latest$ \n| addinfo \n| head 1\n| table info* _raw"
},
"type": "ds.search"
},
"ds_ZKBDXZy2_ds_BlYVOfBA": {
"name": "globalTimeSpl",
"options": {
"enableSmartSources": true,
"query": "| makeresults \n| addinfo\n| eval earliest=IF($calc_earliest|s$!=\"DEFAULT\",$calc_earliest|s$,info_min_time)\n| eval latest=IF($calc_earliest|s$!=\"DEFAULT\",$calc_earliest$+7200, info_max_time)",
"queryParameters": {
"earliest": "$tr_global.earliest$",
"latest": "$tr_global.latest$"
}
},
"type": "ds.search"
},
"ds_ccCiW2S8": {
"name": "tstat",
"options": {
"query": "| tstats count where index=_internal by _time span=1h",
"queryParameters": {
"earliest": "$tr_global.earliest$",
"latest": "$tr_global.latest$"
}
},
"type": "ds.search"
},
"ds_rt307Czb": {
"name": "timeSPL",
"options": {
"enableSmartSources": true,
"query": "| makeresults \n| addinfo",
"queryParameters": {
"earliest": "-60m@m",
"latest": "now"
}
},
"type": "ds.search"
}
},
"layout": {
"globalInputs": [
"input_zIorjrMc"
],
"layoutDefinitions": {
"layout_1": {
"options": {
"display": "auto",
"height": 960,
"width": 1440
},
"structure": [
{
"item": "viz_Nqdf4h2p",
"position": {
"h": 300,
"w": 1390,
"x": 10,
"y": 210
},
"type": "block"
},
{
"item": "viz_NgmH6lHI",
"position": {
"h": 140,
"w": 1390,
"x": 10,
"y": 60
},
"type": "block"
},
{
"item": "viz_BcDlqy4I",
"position": {
"h": 50,
"w": 300,
"x": 20,
"y": 10
},
"type": "block"
},
{
"item": "input_MPUmpGoR",
"position": {
"h": 82,
"w": 198,
"x": 1470,
"y": 50
},
"type": "input"
},
{
"item": "viz_zUx2Zt29",
"position": {
"h": 100,
"w": 680,
"x": 1470,
"y": 130
},
"type": "block"
}
],
"type": "absolute"
}
},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
}
}🌟 Did this answer help you? If so, please consider:
- Adding karma to show it was useful
- Marking it as the solution if it resolved your issue
- Commenting if you need any clarification
Your feedback encourages the volunteers in this community to continue contributing
