Splunk Search

How can I set a conditional time range if the token date range doesn't fit my need?

New Member

I have a dashboard with 3 elements using the time input at the top to drive the search results. One of the three elements is a line graph. I want this line graph to filter based on the time range selected from the top UNLESS it's less than 7 days long.

For example, if they choose last 24 hours, I want the line graph to show the last 7 days. If they choose a date range 7 days or more (like 1/1/2019 through 1/17/2019) then I want it to use this selection.

Essentially, I need the graph to function like such:

IF (($time.latest$ - $time.earliest$) >= 604800, (earliest=$time.earliest$ AND latest=$time.latest$), (earliest=($time.latest$ - 604800) AND latest=$time.latest$))

604800 is the number of seconds in a week.

Thanks!

0 Karma

SplunkTrust
SplunkTrust

You just need to create a second token for the new earliest value, then put your code in a <change> for the visible time control (time1). Use the NewEarliest token as the earliest in the search.

<change>
    <eval token="NewEarliest">if(($time1.latest$ - $time1.earliest$) >= 604800,$time1.earliest$,$time.latest$ - 604800</eval>
</change>

Mathematically, this also can be written as

<change>
    <eval token="NewEarliest">min($time1.earliest$,$time.latest$ - 604800)</eval>
</change>

Since $time1.latest$ will never be changed, you don't need to have a line for it.

New Member

Thanks for the quick response! Forgive me as I am somewhat new to this, but where/what is time1 in your example?

I keep seeing "Search is waiting for input..." after i add the code and save

0 Karma