I have a drill down in dashboard studio panel that returns the start time of some events ($startTime$). I want to use the token as the earliest, and at the same time, I want to use $dd_span$+$startTime$ ($dd_span$ is created from a pulldown menu, it has options of 1d, 1h, 2h, etc).
I wanted to use the start time and end time to narrow down a search in another panel.
index=main (earliest=$startTime$ latest=$startTime$+$dd_span$) | spath ...
does not resolve, is there a way to add the time together?
Hi @JWai28 ,
Assuming you have a time dropdown called "global_time" and a drop-down called "dd_span":
With values set up like this (note the '+' next to each value):
You could try something like this in your search:
index=main [| makeresults
| eval earliest_epoch=strptime("$global_time.earliest$", "%Y-%m-%dT%H:%M:%S.%3QZ")
| eval earliest_relative=relative_time(now(),"$global_time.earliest$")
| eval earliest = coalesce(earliest_epoch, earliest_relative)
| eval latest=relative_time(earliest, "$dd_span$")
| table earliest_epoch, earliest, latest
| return earliest, latest]
Breaking this down:
It's a bit ugly, but should do the job.
Cheers,
Daniel