Yesterday data dashboard filtering -

[nelesama]

An extension of this:
https://community.splunk.com/t5/Splunk-Search/Looking-at-yesterdays-data-but-need-to-filter-the-data...

I've created a dashboard on the above with an input that adds the timewrap line when the option is selected yes and nothing when the option is selected no.

The issue I am having is when no is selected, the graph looks like the following when I select smaller time windows. Below I selected 4 hours but how can I only show the last 4 hours and not the previous window.

Query is as follows:

index=foo 
[| makeresults
| fields - _time
| addinfo
| eval day=mvrange(0,2)
| mvexpand day
| eval earliest=relative_time(info_min_time,"-".day."d")
| eval latest=relative_time(info_max_time,"-".day."d")
| fields earliest latest]
| timechart span=1m sum(value) as value | eval _time=_time

 

[nelesama]

Hi,

The token element works well but when no has been selected from the filter, nothing extra is added to the code. I was wondering how I can stop the graph from being split in two when no is selected

[ITWhisperer]

What happens when you tried my solution?

[ITWhisperer · Accepted solution]

Depending on how you have "removed" the timewrap command you could have a token which starts and ends a comment (```)

index=foo 
$comment$ [| makeresults
| fields - _time
| addinfo
| eval day=mvrange(0,2)
| mvexpand day
| eval earliest=relative_time(info_min_time,"-".day."d")
| eval latest=relative_time(info_max_time,"-".day."d")
| fields earliest latest] $comment$
| timechart span=1m sum(value) as value | eval _time=_time
$comment$ | timewrap 1d $comment$

[nelesama]

Ahh I see what you mean.

Never though to use the comment like that and several times.

Thank you