Splunk Search

how to use timerangepicker's earliest

lihongyan_84
Explorer

I want to only use timerangepicker'e earliest or latest. for example i set my search earliest is @mon and my search latest is timerangepicker's latest; Or i want to display the same day of last month comparing to timerangepticker

Tags (3)
0 Karma

woodcock
Esteemed Legend

Like this:

<form>
  <label>Using half of timepicker</label>
  <description>Using half of timepicker</description>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" token="time_tok1" searchWhenChanged="true">
      <label>Chart Timespan/Width</label>
      <default>Last 24 hours</default>
    </input>
  </fieldset>
  <row>
      <chart>
        <title>Using earliest only</title>
        <searchString>earliest=$time_tok1.earliest$ latest=now() Your Search Here</searchString>
      </chart>
  </row>
  <row>
      <chart>
        <title>Using latest only</title>
        <searchString>earliest=0 latest=$time_tok1.latest$ Your Search Here</searchString>
      </chart>
  </row>
</form>
0 Karma

Ayn
Legend

Uhh...could you clarify what you want to do a bit more please?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...