Dashboards & Visualizations

What is the token name of the Search form's time range picker?

j_w_660
Engager

I want to display human readable timestamps for the Search form's default time range picker earliest and latest values. But, I can't figure out what the token name of the time range picker is.

I'm generating a SQL query to use in DB Connect and I want to specify the same time range in the SQL query as the time range picker on the Search form/page.

I'm looking for something like this to put into the SQL where clause:

| stats count | eval start=relative_time(now(), $earliest$) | convert ctime(start) | table start

where $earliest$ is coming from the standard/default time range picker.

0 Karma
1 Solution

somesoni2
Revered Legend

If your Splunk search is using the time range picker, you can try like this. The gentimes is just to generate one sample row. The addinfo command is what get the absolute epoch value of the selected time range picker value.

| gentimes start=-1  | addinfo | table info_min_time info_max_time | rename info_min_time  as earliest info_max_time as latest | convert ctime(earliest) ctime(latest)

View solution in original post

somesoni2
Revered Legend

If your Splunk search is using the time range picker, you can try like this. The gentimes is just to generate one sample row. The addinfo command is what get the absolute epoch value of the selected time range picker value.

| gentimes start=-1  | addinfo | table info_min_time info_max_time | rename info_min_time  as earliest info_max_time as latest | convert ctime(earliest) ctime(latest)

DalJeanis
Legend

Somesoni2 - you should move that comment to be an answer so he can accept it. Addinfo is exactly what he needs.

0 Karma

somesoni2
Revered Legend

You want to add columns in the search result (from default search dashboard) OR you're creating a dashboard and want to selected timerange in some lebel/title?

0 Karma

j_w_660
Engager

I'm generating a SQL query to use in DB Connect and I want to specify the same time range in the SQL query as the time range picker on the Search form/page.

I'm looking for something like this:

| stats count | eval start=relative_time(now(), $earliest$) | convert ctime(start) | table start

where $earliest$ is coming from the standard/default time range picker.

0 Karma

somesoni2
Revered Legend

Could you provide the SQL Query/Splunk Search that you're using right now? Are you using dbxquery or dbquery command to run the SQL and want to add current time range into WHERE clause somewhere?

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...