Monitoring Splunk

timestamp

ybvv9494
Observer

i am preparing a Splunk dashboard .in my dashboard i fixed the timestamp at the starting of the dashboard and all the data will be displayed with that. now i need to fix another time chart separately only for one chart that represents incoming data of Previous data at this timestamp. How to fix this.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is the panel a fixed time difference from the timepicker value? If so, evaluate an extra token (or two) in the timepicker based on the selected timeframe.

0 Karma

ybvv9494
Observer

All the dashboard has a Primary timestamp and all the charts follow the same timestamp but in one chart we need the same timestamp data of yesterday.

for example: suppose we need to get data for last 4 hours(i.e 1 AM TO 5 AM) all  the charts represent last four hours data but in one chart it should show last 4 hours timestamp(1 AM to 5 AM) of previous days.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Add this to your timepicker and use these tokens in the earliest and latest settings for the panel you want to be 1 day earlier

      <change>
        <eval token="earliestdaybefore">relative_time(relative_time(now(),$earliest$),"-1d")</eval>
        <eval token="latestdaybefore">relative_time(relative_time(now(),$latest$),"-1d")</eval>
      </change>

gcusello
Legend

Hi @ybvv9494,

you can put another Time Picker (eventually inside the panle) in your dashboard.

Only one attention: use a different name for the token.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...