Splunk Search

Problem with token eval I am trying to rest one hour to fiel1latest

rutdesanti
New Member

What I am doing wrong, I am trying to rest one hour to fiel1latest

    <label>otro</label>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Timepicker</label>
      <default><done>
        <eval token="newtime">$$field1.latest$$,"-1@h"</eval></done>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>ind
| stats count by _time</query>
          <earliest>$$newtime$$</earliest>
          <latest>$$field1.latest$$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
Tags (1)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @rutdesanti

I made some minor changes and this is working for me :

  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Timepicker</label>
      <default>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=int_gcg_mex_accimarket_151486
 | stats count by _time</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>

Does it do what you want?

0 Karma

rutdesanti
New Member

Can you please delete the index

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...