Dashboards & Visualizations

"Snap-To" 1 min time selected using shared time range picker in dashboard.

jss
Loves-to-Learn

I have a single visualization and line chart dashbord panels (there are more panels as well) which are linked to shared time range picker. In my case data is loaded into splunk after every 1 minute. How can I configure 'latest' time of these panels to snap to 1 min if I select Last 15 mins (earliest=now) from presets in time range picker so that it doesn't display '0' in panels? 
On selecting last 15 minutes from presets in shared time range picker 0 is displayed in single value and line chart visualization  

 

 

index=index1 sourcetype=sourcetype_name
| timechart span=1min sum(call_rate)

 

 

 

Capture.PNGCapture1.PNG

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=index1 sourcetype=sourcetype_name earliest="@m-15m" latest="@m-1m"
| timechart span=1min sum(call_rate)
0 Karma

jss
Loves-to-Learn

Actually the query is linked to shared time picker for whole dashboard. The xml looks like following:

<row>
    <panel>
      <single>
        <title>Call Rate</title>
        <search>
          <query>index=index1 sourcetype=sourcetype_name
| timechart span=1min sum(call_rate)</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <refresh>5m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="useColors">1</option>
      </single>
    </panel>
</row>

 

I want if I select any time from time range picker, 'latest' time should snap to beginning of the minute. How can I do it using tokens in 'earliest' and 'latest'?

P.S: field1 is token for Time input of dashboard

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set a token in your timepicker change handler and use that instead

      <change>
        <eval token="tokTimeLatestStartOfMinute">relative_time(relative_time(now(),'latest')-1,"@m")</eval>
      </change>

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...