Variable earliest/latest in main search

[DATT]

I have a working dashboard that displays a number of metrics and KPIs for the previous week.  Today, I was asked to expand that dashboard to include a dropdown of all previous weeks over the last year

Using this query I was able to fill in my dashboard dropdown pretty easily

| makeresults 
| eval START_EPOCH = relative_time(_time,"-1y@w1")
| eval END_EPOCH = START_EPOCH + (60 * 60 * 24 * 358)
| eval EPOCH_RANGE = mvrange(START_EPOCH, END_EPOCH, 86400 * 7)
| mvexpand EPOCH_RANGE

| eval END_EPOCH = EPOCH_RANGE + (86400 * 7)

| eval START_DATE_FRIENDLY = strftime(EPOCH_RANGE, "%m/%d/%Y")
| eval END_DATE_FRIENDLY = strftime(END_EPOCH, "%m/%d/%Y")
| eval DATE_RANGE_FRIENDLY = START_DATE_FRIENDLY + " - " + END_DATE_FRIENDLY

| table DATE_RANGE_FRIENDLY, EPOCH_RANGE
| reverse

Using this I get a dropdown with values such as 

10/07/2024 - 10/14/2024
09/30/2024 - 10/07/2024

And so on, going back a year.

Adding it to my search as a token has been more challenging though. Here's what I'm trying to do:

index=someIndex earliest=$token_epoch$ latest=$token_epoch$+604800

 Doing this I get "Invalid latest_time: latest_time must be after earliest_time."

I've seen some answers around here that involve running the search then using WHERE to apply earliest and latest.  I'd like to avoid that because the number of records that would have to pulled before I could filter on earliest and latest is in the many millions. 

I've also considered using the timepicker but my concern there is the users who use this dashboard will pick the wrong dates.  I'd like to limit that by hardcoding the first and last days of the search via the dropdown.

Is there a way to accomplish relative earliest and latest dates/times like this?

[ITWhisperer · Accepted solution]

index=someIndex
    [| makeresults
    | eval earliest=$token_epoch$
    | eval latest=earliest+604800
    | table earliest latest]

[DATT]

This did the trick for me.  I've used subsearches elsewhere in my dashboards and reporting, just didn't to use it with makeresults as well.

[inventsekar]

Hi @DATT , pls check this one:

| makeresults
| eval latestEpoch=$token_epoch$ + 604800
| index=someIndex earliest=$token_epoch$ latest=latestEpoch