Time range picker -1d

[kylecobb]

Hello,
I'm not even sure how to ask this question correctly but we are running a trend analysis. The below dashboard shows us the last 60 minutes from today, yesterday, last week, and last month... What we are trying to do is convert the timepicker to allow us to use it's "data/time" feature. So I can look at for example, this morning from 4am to 5am;today, yesterday, last week, last month. Not just a set amount of time. I guess what we need is a way to run this dashboard dynamically. Can anyone point me in the right direction or some clues on how to make this function. Thank you so much!

Dashboard
$time$=-60m to now
<query>index= | timechart</query>
<earliest>$time$</earliest>
<latest><$time$</latest>
<query>index= | timechart</query>
<earliest>-25h</earliest>
<latest><-24h</latest>
<query>index= | timechart</query>
<earliest>-170h</earliest>
<latest>-7d</latest>
<query>index= | timechart</query>
<earliest>-674h</earliest>
<latest>-28d</latest>

[jkat54]

It's something like this assuming you've used "time" as your token for the timepicker:

     <chart>
       <search>
         <query>
           search query
         </query>
         <earliest>$time.earliest$</earliest>
         <latest>$time.latest$</latest>
       </search>
     </chart>
     <chart>
       <search>
         <query>
           search query
         </query>
         <earliest>$time.earliest$-25h</earliest>
         <latest>$time.latest$-24h</latest>
       </search>
     </chart>

And it can greatly vary between versions of splunk due to some nice upgrades since 6.0. Always good to check for your version of the docs.

http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens

[kylecobb]

This format just simply does not work for us for some reason. It looks easy but running this query simply gives us an error.