Dashboards & Visualizations

set time range token with multiselect input

Zero
Engager

I have a mutiselect input like this

 

<input type="multiselect" token="year">
<label>Year</label>
<choice value="*">All</choice>
<delimiter> OR year=</delimiter>
<fieldForLabel>year</fieldForLabel>
<fieldForValue>year</fieldForValue>
<search>
<query>| inputlookup supported_years.csv
| dedup year
| table year</query>
</search>
<default>2023</default>
<initialValue>2023</initialValue>
</input>

 



I want to set the time range token to the result of the input selection above. If 2023 was chosen, the token value for $timeRangeEarliest$ should be 2023/01/01 and the token value for $timeRangeLastet$ should be 2023/12/31.  If 2021 and 2023 was chosen, the token value for $timeRangeEarliest$ should be 2021/01/01 and the token value for $timeRangeLastet$ should be 2023/12/31. Etc.

I want to use this two tokens for time range in search. Don't know how to do it. Please help. Many thanks.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your question is a little confusing. You have mentioned the same token twice. Also, please can you clarify what you want if three different years are chosen? Also, how are you going to use the token(s) as this makes a difference to how they might be set up?

0 Karma

Zero
Engager

Thanks for your reply.

Sorry for the two identical token name, this was a typo and I have corrected it.

If there are three or more years, I want to find the earliest year and the latest year, and use the date as tokens. (I just want to find the smallest time range that covers all those years.) And I want to use the tokens for time range of searches in dashboard. Like this:

<search>
<query>| index=abc</query>
<earliest>$timeRangeEarliest$</earliest>
<latest>$timeRangeLastet$</latest>
</search>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this - note that is doesn't deal with All - for that (should you decide it is necessary), you would have to do something a bit more complicated

<input type="multiselect" token="year">
<label>Year</label>
<fieldForLabel>year</fieldForLabel>
<fieldForValue>year</fieldForValue>
<search>
<query>| inputlookup supported_years.csv
| dedup year
| table year</query>
</search>
<default>2023</default>
<initialValue>2023</initialValue>
      <change>
        <eval token="earliest">mvindex(mvsort($form.year$),0)</eval>
        <eval token="latest">mvindex(mvsort($form.year$),mvcount($form.year$)-1)</eval>
        <eval token="timeRangeEarliest">strptime($earliest$."0101","%Y%m%d")</eval>
        <eval token="timeRangeLatest">relative_time(strptime(($latest$)."0101","%Y%m%d"),"+1y")</eval>
      </change>
</input>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...

Upgrade Prep for 10.4, Network Observability Deep Dives, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...