Dashboards & Visualizations

Why am I only getting results for the last selected values even though I've selected multiple date/times in my dashboard?

New Member

I have the below search in one of my dashboards. I have a mutiselect field in my dashboard: one for picking the start date/time and another for end date/time. When i select multiple date/time, I'm getting only results for last selected values, it's not coming for multiple times selected.

sourcetype=smapi $earliest$ $latest$ assetGroup=pdc1c dimeName="KeyEvent" status="OK" actionName="searchlegal" | table actionName transId response _time
0 Karma


The short answer is that earliest= can only accommodate one value, and so can latest=.

If you want to run multiple simultaneous searches for different time periods, then you are going to have to do a lot of custom code to make it happen (for example, setting up your searches using map or multisearch), not just straight-out-of-the-box multiselect for some time fields.

For example, see the final answer ( multisearch ) in this question


0 Karma

New Member

thank you @DalJeanis.... how can we be build the query dynamically...number of different time ranges will be different everytime.....sometimes we need to compare with 2 or more

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST