Splunk Search

How to add to or subtract one hour to time tokens to be passed in a drilldown?


Hi folks,

I'm running the transaction command in a drilldown panel that passes the times picked on the timechart down to the next panel as tokens. The problem I run into is where the transactions don't fall within the hour slice, I want the token to subtract an hour from the earliest time, and add an hour to the latest, so I can encompass the transaction.

I tried $earliest_time$ - 1h

Splunk says "Invalid earliest_time"

Is there a way to offset the tokens this way?

0 Karma

Path Finder

Did you ever find a solution to this?

I've tried so many combinations of 'possible solutions' I've seen posted, but none of them have worked for me.

0 Karma


You could change your token before it is consumed by the search. Do this in your drilldown:

    <eval token="time_tok_plus_1h_earliest">relative_time(relative_time(now(), 'earliest'), "+1h")</eval>
    <eval token="time_tok_plus_1h_latest">relative_time(relative_time(now(), 'latest'), "+1h")</eval>

Replace earliest and latest with wherever your values come from, e.g. click.value.

Revered Legend

I guess the earliest and latest value that you get from the drilldown will in epoch, so try one of these in the drilldown search

your base search earliest=($earliest_time$-3600) ...rest of the search


your base search [| gentimes start=-1 |eval earliest=$earliest_time$-3600 | table earliest ]
0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...