Splunk Search

Time range picker -1d

kylecobb
New Member

Hello,
I'm not even sure how to ask this question correctly but we are running a trend analysis. The below dashboard shows us the last 60 minutes from today, yesterday, last week, and last month... What we are trying to do is convert the timepicker to allow us to use it's "data/time" feature. So I can look at for example, this morning from 4am to 5am;today, yesterday, last week, last month. Not just a set amount of time. I guess what we need is a way to run this dashboard dynamically. Can anyone point me in the right direction or some clues on how to make this function. Thank you so much!

Dashboard
$time$=-60m to now
<query>index= | timechart</query>
<earliest>$time$</earliest>
<latest><$time$</latest>
<query>index= | timechart</query>
<earliest>-25h</earliest>
<latest><-24h</latest>
<query>index= | timechart</query>
<earliest>-170h</earliest>
<latest>-7d</latest>
<query>index= | timechart</query>
<earliest>-674h</earliest>
<latest>-28d</latest>

0 Karma

jkat54
SplunkTrust
SplunkTrust

It's something like this assuming you've used "time" as your token for the timepicker:

     <chart>
       <search>
         <query>
           search query
         </query>
         <earliest>$time.earliest$</earliest>
         <latest>$time.latest$</latest>
       </search>
     </chart>
     <chart>
       <search>
         <query>
           search query
         </query>
         <earliest>$time.earliest$-25h</earliest>
         <latest>$time.latest$-24h</latest>
       </search>
     </chart>

And it can greatly vary between versions of splunk due to some nice upgrades since 6.0. Always good to check for your version of the docs.

http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens

0 Karma

kylecobb
New Member

This format just simply does not work for us for some reason. It looks easy but running this query simply gives us an error.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...