Splunk Search

How to input a single epoch time from a dashboard URL as a time range inside the time picker

pkol
Explorer

Hey gang,
I have an external system which can call a dashboard URL - but it can only supply a single epoch time
How do I use a dashboard to turn that time into a time range?

I tried making a new "text input" and use the "text input's" token in the URL to input the epoch time,
then I used a tag inside the "text input" to update my time picker by adding and subtracting 15 mins to the supplied epoch time. The problem with this approach is that the time picker dosent update as soon as the URL loads since my manipulation is done inside a change tag.
Can anyone help me out please?
Thank you.
Here's my XML:

 <input type="time" token="time_pick" searchWhenChanged="true">
      <label>Time range</label>
      <default>
        <earliest>-20m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="trigger_time">
      <label>trigger_time_test</label>
      <change>
        <eval token="time_pick.earliest">$trigger_time$ - 900</eval>
        <eval token="time_pick.latest">$trigger_time$ + 900</eval>
      </change>
    </input>

to4kawa
Ultra Champion
<form>
  <label>Search by input text of epoch time</label>
  <fieldset submitButton="false">
    <input type="text" token="time" searchWhenChanged="true">
      <label>epoch time</label>
      <change>
        <eval token="time_pick.earliest">$time$ - 900</eval>
        <eval token="time_pick.latest">$time$ + 900</eval>
      </change>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval min_time=$time_pick.earliest$, max_time=$time_pick.latest$
| table *</query>
          <earliest>$time_pick.earliest$</earliest>
          <latest>$time_pick.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">/app/search/search?earliest=$time_pick.earliest$&amp;latest=$time_pick.latest$&amp;q=%7C%20makeresults&amp;display.page.search.mode=smart&amp;dispatch.sample_ratio=1&amp;workload_pool=&amp;display.general.type=statistics&amp;display.page.search.tab=statistics</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

This is an example.
It may be a little different, but the search period is set from the time of the text box.

0 Karma
Get Updates on the Splunk Community!

Best Strategies to Optimize Observability Costs

 Join us on Tuesday, May 6, 2025, at 11 AM PDT / 2 PM EDT for an insightful session on optimizing ...

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...