Splunk Search

How do I calculate another time frame based on time input?

Kallantin
New Member

I am trying to build a dash where I need to calculate another earliest and latest based on an input of time.

The second time would get calculated depending on the values in a dropdown, see below example.

I want to add 90,180 or 1 year to the time set in the input="time". I have tried to add the calculations into the input but it is not returning any values. I have also tried to include

        | eval calc_early=strptime($main_time.earliest$,"%Y-%m-%d")
        | eval comp_early=relative_time(calc_early,$review_modifier$)
        | eval calc_late=strptime($main_time.latest$,"%Y-%m-%d")
        | eval comp_late=relative_time(calc_late,$review_modifier$)

In the query itself but that is also not working.

<input type="time" searchWhenChanged="true" token="main_time">
  <label>Date Range for 'over time' reports</label>
  <default>
    <earliest>-6mon@mon</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="dropdown" searchWhenChanged="true" depends="$display_review$" token="compare_time">
  <label>Compare Range:</label>
  <default>Previous 180 Days</default>
    <choice value="Quarter">Previous Quarter</choice>
    <choice value="Halfyear">Previous 180 Days</choice>
    <choice value="Lastyear">Previous Year</choice>
    <change>
      <condition value="Quarter">
        <set token="review_modifier">-1q@q</set>
        <set token="review_epoch">7776000</set>
      </condition>
      <condition value="Halfyear">
        <set token="review_modifier">-6mon@mon</set>
        <set token="review_epoch">15552000</set>
      </condition>
      <condition value="Lastyear">
        <set token="review_modifier">-1y@y</set>
        <set token="review_epoch">31536000</set>
      </condition>
     <search>
      <query>
        | eval calc_early=strptime($main_time.earliest$,"%Y-%m-%d")
        | eval comp_early=relative_time(calc_early,$review_modifier$)
        | eval calc_late=strptime($main_time.latest$,"%Y-%m-%d")
        | eval comp_late=relative_time(calc_late,$review_modifier$)
      </query>
     </search>
     </change>
</input>

Any help appreciated as I am not sure what I am doing wrong.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...