Monitoring Splunk

timestamp

ybvv9494
Observer

i am preparing a Splunk dashboard .in my dashboard i fixed the timestamp at the starting of the dashboard and all the data will be displayed with that. now i need to fix another time chart separately only for one chart that represents incoming data of Previous data at this timestamp. How to fix this.

Labels (1)
0 Karma

ITWhisperer
Ultra Champion

Is the panel a fixed time difference from the timepicker value? If so, evaluate an extra token (or two) in the timepicker based on the selected timeframe.

0 Karma

ybvv9494
Observer

All the dashboard has a Primary timestamp and all the charts follow the same timestamp but in one chart we need the same timestamp data of yesterday.

for example: suppose we need to get data for last 4 hours(i.e 1 AM TO 5 AM) all  the charts represent last four hours data but in one chart it should show last 4 hours timestamp(1 AM to 5 AM) of previous days.

0 Karma

ITWhisperer
Ultra Champion

Add this to your timepicker and use these tokens in the earliest and latest settings for the panel you want to be 1 day earlier

      <change>
        <eval token="earliestdaybefore">relative_time(relative_time(now(),$earliest$),"-1d")</eval>
        <eval token="latestdaybefore">relative_time(relative_time(now(),$latest$),"-1d")</eval>
      </change>

gcusello
SplunkTrust
SplunkTrust

Hi @ybvv9494,

you can put another Time Picker (eventually inside the panle) in your dashboard.

Only one attention: use a different name for the token.

Ciao.

Giuseppe

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!