Splunk Search

Using a Token to set the earliest value in a multi index search

Steve_A200
Path Finder

Hi, 

I am trying to create a splunk classic dashboard, but struggling with setting the earliest values.

The goal is to run a search, and have the results pull data from 2 different index files while controlling the data pulled from the first index by a dropdown time parameter.

The SPL is part of a radio button option with the dashboard and starts as such:

( (index=first_index source="first_file_location" $time_range$ latest=-1d@d() ) OR
(index=second_index earliest=@d latest=now() source="second_file_location")
... rest of the SPL


time_range token is the dropdown input with a static value set to
earliest=-7d@d()


When I run the search, it is not substituting the static value into the search, and is populating it as the token name with the $ sign.

Would it be possible to set the earliest value for the first index using a dropdown menu.

Any assistance would be greatly appreciated.

Thanks

Labels (1)
0 Karma
1 Solution

Steve_A200
Path Finder

I figured it out, the universal _time would be used by default when no earliest/latest parameters are specified.

 

View solution in original post

Steve_A200
Path Finder

I figured it out, the universal _time would be used by default when no earliest/latest parameters are specified.

 

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...