Why am I only getting results for the last selected values even though I've selected multiple date/times in my dashboard?

[praja1983]

I have the below search in one of my dashboards. I have a mutiselect field in my dashboard: one for picking the start date/time and another for end date/time. When i select multiple date/time, I'm getting only results for last selected values, it's not coming for multiple times selected.

sourcetype=smapi $earliest$ $latest$ assetGroup=pdc1c dimeName="KeyEvent" status="OK" actionName="searchlegal" | table actionName transId response _time

[DalJeanis]

The short answer is that earliest= can only accommodate one value, and so can latest=.

If you want to run multiple simultaneous searches for different time periods, then you are going to have to do a lot of custom code to make it happen (for example, setting up your searches using map or multisearch), not just straight-out-of-the-box multiselect for some time fields.

For example, see the final answer ( multisearch ) in this question

https://answers.splunk.com/answers/142472/how-to-run-different-timerange-in-subsearch-versus-outer-s...

[praja1983]

thank you @DalJeanis.... how can we be build the query dynamically...number of different time ranges will be different everytime.....sometimes we need to compare with 2 or more