Splunk Search

Problem with token eval I am trying to rest one hour to fiel1latest

rutdesanti
New Member

What I am doing wrong, I am trying to rest one hour to fiel1latest

    <label>otro</label>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Timepicker</label>
      <default><done>
        <eval token="newtime">$$field1.latest$$,"-1@h"</eval></done>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>ind
| stats count by _time</query>
          <earliest>$$newtime$$</earliest>
          <latest>$$field1.latest$$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
Tags (1)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @rutdesanti

I made some minor changes and this is working for me :

  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Timepicker</label>
      <default>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=int_gcg_mex_accimarket_151486
 | stats count by _time</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>

Does it do what you want?

0 Karma

rutdesanti
New Member

Can you please delete the index

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...