how to use add time to token in dashboard studio

[JWai28]

I have a drill down in dashboard studio panel that returns the start time of some events ($startTime$). I want to use the token as the earliest, and at the same time, I want to use $dd_span$+$startTime$ ($dd_span$ is created from a pulldown menu, it has options of 1d, 1h, 2h, etc).

I wanted to use the start time and end time to narrow down a search in another panel.
index=main (earliest=$startTime$ latest=$startTime$+$dd_span$) | spath ...
does not resolve, is there a way to add the time together?

[danspav]

Hi @JWai28 ,

Assuming you have a time dropdown called "global_time" and a drop-down called "dd_span":

With values set up like this (note the '+' next to each value):

You could try something like this in your search:

index=main [| makeresults 
| eval earliest_epoch=strptime("$global_time.earliest$", "%Y-%m-%dT%H:%M:%S.%3QZ")
| eval earliest_relative=relative_time(now(),"$global_time.earliest$")
| eval earliest = coalesce(earliest_epoch, earliest_relative)
| eval latest=relative_time(earliest, "$dd_span$") 
| table earliest_epoch, earliest, latest 
| return earliest, latest]

Breaking this down:

1. This converts the global_time.earliest token into an epoch time (The dashboard either supplies a date string, or something like "-15m" - both cases are catered for).
2. Then it creates the latest token based on the earliest time.
3. Finally, it returns those values to the main search - setting the earliest and latest values.

It's a bit ugly, but should do the job.

Cheers,
Daniel