Splunk Enterprise

How to pass "Preset Timeranges" as tokens in query

Ashwini008
Builder

HI,

I am trying to pass presets from timepicker as tokens in my query.

EX: "BETWEEN" ,"SINCE"

earliest = 23/08/2020 latest 24/08/2020

I need to pass above date when I select "BETWEEN" in timerange picker as token in my query.

Similarly when I select since,last24hrs,last7days,etc.

current code used:

 <input type="time" id="date" token="lowerdate" searchWhenChanged="true">
        <label>Date</label>
        <default>
          <earliest>*</earliest>
          <latest>*</latest>
        </default>
      </input>

<search>
          <queryindex = ABCD  |search DATE = $db_earliest$|table DATE</query>
          <earliest>-48h@h</earliest>
          <latest>now</latest>
           <progress>

          <eval token="db_earliest">strftime("$lowerdate.earliest$", "%Y%m%d")</eval>

          <eval token="db_latest">if (match("$lowerdate.latest$","now"), strftime(now(),"%Y%m%d"), strftime("$lowerdate.latest$", "%Y%m%d"))</eval>

</progress>
 </search>

any suggestions would be great

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...