Splunk Search

Problem with token eval I am trying to rest one hour to fiel1latest

rutdesanti
New Member

What I am doing wrong, I am trying to rest one hour to fiel1latest

    <label>otro</label>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Timepicker</label>
      <default><done>
        <eval token="newtime">$$field1.latest$$,"-1@h"</eval></done>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>ind
| stats count by _time</query>
          <earliest>$$newtime$$</earliest>
          <latest>$$field1.latest$$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
Tags (1)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @rutdesanti

I made some minor changes and this is working for me :

  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Timepicker</label>
      <default>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=int_gcg_mex_accimarket_151486
 | stats count by _time</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>

Does it do what you want?

0 Karma

rutdesanti
New Member

Can you please delete the index

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...