i am preparing a Splunk dashboard .in my dashboard i fixed the timestamp at the starting of the dashboard and all the data will be displayed with that. now i need to fix another time chart separately only for one chart that represents incoming data of Previous data at this timestamp. How to fix this.
All the dashboard has a Primary timestamp and all the charts follow the same timestamp but in one chart we need the same timestamp data of yesterday.
for example: suppose we need to get data for last 4 hours(i.e 1 AM TO 5 AM) all the charts represent last four hours data but in one chart it should show last 4 hours timestamp(1 AM to 5 AM) of previous days.