Dashboards & Visualizations

Why am I only getting results for the last selected values even though I've selected multiple date/times in my dashboard?

praja1983
New Member

I have the below search in one of my dashboards. I have a mutiselect field in my dashboard: one for picking the start date/time and another for end date/time. When i select multiple date/time, I'm getting only results for last selected values, it's not coming for multiple times selected.

sourcetype=smapi $earliest$ $latest$ assetGroup=pdc1c dimeName="KeyEvent" status="OK" actionName="searchlegal" | table actionName transId response _time
0 Karma

DalJeanis
Legend

The short answer is that earliest= can only accommodate one value, and so can latest=.

If you want to run multiple simultaneous searches for different time periods, then you are going to have to do a lot of custom code to make it happen (for example, setting up your searches using map or multisearch), not just straight-out-of-the-box multiselect for some time fields.

For example, see the final answer ( multisearch ) in this question

https://answers.splunk.com/answers/142472/how-to-run-different-timerange-in-subsearch-versus-outer-s...

0 Karma

praja1983
New Member

thank you @DalJeanis.... how can we be build the query dynamically...number of different time ranges will be different everytime.....sometimes we need to compare with 2 or more

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...