Splunk Search

How to link dynamically the range time picker with a relative time?

jip31
Motivator

hi

as you can see I use a relative time in my search in order to filter events on today between 7h and 19h

 

earliest=@d+7h latest=@d+19h 

 

 Now I would like to be able to link this relative time with my timepicher in order to change the period slot, for example I need to display events on the last 7 days between 7h and 19 or on the last 24h between 7h and 19h

is it possible to do that?

thanks

 

 

<form>
  <label>CAP</label>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>`index_mes` sourcetype=web_request earliest=@d+7h latest=@d+19h 

 

 

Tags (1)
0 Karma
1 Solution

PaulPanther
Motivator

One solution could be to define a customized timepicker https://community.splunk.com/t5/All-Apps-and-Add-ons/Limit-choices-in-default-TIMEPICKER/

or something like this

 

<form>
  <label>CAP</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="earliest_day">
      <label></label>
      <choice value="-1d">Yesterday</choice>
      <choice value="-7d">Last_Week</choice>
      <default>-1d</default>
 <change>
   <condition value="-1d">
   </condition>
   <condition>
   <set token="latest_day">>-1d</set>
   </condition>
  </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>`index_mes` sourcetype=web_request earliest=$earliest_day$@d+7h latest=$latest_day$@d+19h 

 

 

 

 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You could modify the query to filter results based on the hour.

<form>
  <label>CAP</label>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>`index_mes` sourcetype=web_request 
| where (date_hour > 7 AND date_hour < 19)

If the date_hour field is not available in your events then you can extract it from _time.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PaulPanther
Motivator

One solution could be to define a customized timepicker https://community.splunk.com/t5/All-Apps-and-Add-ons/Limit-choices-in-default-TIMEPICKER/

or something like this

 

<form>
  <label>CAP</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="earliest_day">
      <label></label>
      <choice value="-1d">Yesterday</choice>
      <choice value="-7d">Last_Week</choice>
      <default>-1d</default>
 <change>
   <condition value="-1d">
   </condition>
   <condition>
   <set token="latest_day">>-1d</set>
   </condition>
  </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>`index_mes` sourcetype=web_request earliest=$earliest_day$@d+7h latest=$latest_day$@d+19h 

 

 

 

 

0 Karma

jip31
Motivator

perfect thanks

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...