Changing the search used, based upon the time range selected

[jdunlea_splunk]

I am wondering if we can change a search on a dashboard based upon the time range selected.

EG: I have a hidden search module which runs a dashboard. The search looks for: "index=A foo=X". However this is fine for the last 24 hours.... but if i select the last 7 days, I want the search to be "index=A foo=Y"

Is there a way to change these underlying searches based upon the selection of a different time range?

Thanks!

[dwaddle · Accepted solution]

Not an elegant way, but a way that does seem to work and is suitable for use in a dashboard. Use a subsearch.

index=A 
[ 
   search index=A
   | head 1 
   | addinfo 
   | eval foo=if(info_max_time-info_min_time <= 86400,"X","Y") 
   | fields foo
]

This will let the subsearch compute the value for foo based on the relative values of info_max_time and info_min_time that addinfo includes into the search.

[jdunlea_splunk]

Nice! That looks like it will work.

I will try it and update if I see any related issues.

Thanks!