Dashboards & Visualizations

how can I set a time range based on a time token

kiamco
Path Finder

I have this query

index=summary source="summary_events_2" 
orig_source=*pnr*
ms_region=us-west-1
(ms_level=ERROR OR ms_level=error)
NOT event=no-event
| stats sum(count) as count by  event, ms_level,_time
|appendcols [|search earliest=-14d index=summary source="summary_events_2" 
              orig_source=*pnr*
             ms_region=$region$
             (ms_level=ERROR OR ms_level=error) 
             | stats sparkline(sum(count),1d) as trend_span_1d
                     sparkline(sum(count),7d) as trend_span_7d
                     by  event, ms_level]
| where count!=""

my problem is that I want to create a specific time range for sparkline. Keep in mind that I am using a drill down time token with this query. I have been searching for a way to return a range based on a time token, any ideas?
eg: starting at the $time_token$ and the past 14 days

0 Karma

somesoni2
Revered Legend

Assuming your time token is applied to the main search (before appendcols), give this a try

index=summary source="summary_events_2" 
 orig_source=*pnr*
 ms_region=us-west-1
 (ms_level=ERROR OR ms_level=error)
 NOT event=no-event
 | stats sum(count) as count by  event, ms_level,_time
 |appendcols [search [| gentimes start=-1 | addinfo | eval earliest=relative_time(info_min_time,"-14d") | eval latest=info_min_time | table earliest latest ] index=summary source="summary_events_2" 
               orig_source=*pnr*
              ms_region=$region$
              (ms_level=ERROR OR ms_level=error) 
              | stats sparkline(sum(count),1d) as trend_span_1d
                      sparkline(sum(count),7d) as trend_span_7d
                      by  event, ms_level]
 | where count!=""
0 Karma

kiamco
Path Finder

ye a this would work if applied the time token before the appendcols but unfortunately that is no the case. what I am trying to basically do is when user clicks on graph it will show the events in that specific point in time but I want the sparkline to show the trend of that event starting from 14 days before the "time_token".

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...