Splunk Enterprise

How to pass "Preset Timeranges" as tokens in query

Ashwini008
Builder

HI,

I am trying to pass presets from timepicker as tokens in my query.

EX: "BETWEEN" ,"SINCE"

earliest = 23/08/2020 latest 24/08/2020

I need to pass above date when I select "BETWEEN" in timerange picker as token in my query.

Similarly when I select since,last24hrs,last7days,etc.

current code used:

 <input type="time" id="date" token="lowerdate" searchWhenChanged="true">
        <label>Date</label>
        <default>
          <earliest>*</earliest>
          <latest>*</latest>
        </default>
      </input>

<search>
          <queryindex = ABCD  |search DATE = $db_earliest$|table DATE</query>
          <earliest>-48h@h</earliest>
          <latest>now</latest>
           <progress>

          <eval token="db_earliest">strftime("$lowerdate.earliest$", "%Y%m%d")</eval>

          <eval token="db_latest">if (match("$lowerdate.latest$","now"), strftime(now(),"%Y%m%d"), strftime("$lowerdate.latest$", "%Y%m%d"))</eval>

</progress>
 </search>

any suggestions would be great

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...