Multiple time searches

[MrJohn230]

I have the below search and I'm trying to search for different time periods within each search. 

So for example msg="*Completed *" is using the timepicker input. 

I would like to search for data one hour before the timepicker search (so this should be dynamic) for msg="*First *"

I'm not sure if this is possible.

I'm comparing these two searches and the initial log msg="*First*" can occur several minutes before the msg=*Completed*" log. So when I compare some of these log messages get cut off depending on when I select my timepicker. I would like to search for these message 1 hour before my timepicker selection. 

Long term this search will go into a splunk dashboard. 

(index=color name IN ("green","blue")  msg="*First *" ```earliest="11/09/2023:09:00:00" latest="11/09/2023:12:59:59"```)
OR
(index=color name IN ("blue2","green2") msg="*Completed *")

[bowesmana]

It's easy enough in a dashboard to create one time range for searches based on an input time range set in the time picker. You just create a global search that uses time picker time and then use addinfo to get the epoch range of the time picker and do calculations on that and set appropriate tokens.

Here are a some example posts that talk about it in dashboards.

https://community.splunk.com/t5/Getting-Data-In/How-to-count-events-for-specific-time-period-now-and...

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-dynamic-label-based-on-time-...

https://community.splunk.com/t5/Dashboards-Visualizations/How-convert-input-date-time-to-token-value...

[isoutamo]

Hi
This is doable. You could e.g. add several time pickers on your dashboards and add those to your queries as tokens. I cannot recall now if this needs you to add additional tokens to set those limits correctly in your search?
r. Ismo