using different date range but showing the same value

[ramkyreddy]

When I was searching  for the different data ranges in my Splunk dashboard it showed the same,
for example, i am selecting 1/1/2024 to 1/10/2024 and  1/3/2024 to 1/4/2024 and
i am adding this query earliest=-7d@d latest=+1d but when removed these values do not match

 Please help out with this

[ITWhisperer]

Looks like your search may be wrong - please share the source of your dashboard in a code block

[ramkyreddy]

selected the date from 1 jan 2024 to 2 jan 2024
----------------------------------------------------------------
index="bsds_gans" earliest=1704096000 latest=+1d pfor IN (*) test IN (*) name IN (*) ckb IN (*) vrsion IN (*) id IN (*) location IN (*) group IN (*)

| eval pfor=upper(pfor)
| eval _time = start_time
| eval WW=strftime(_time, "%V.%w")
| eval name=mvindex(split(context,"."),1)
| search name !="*Case Setup*"
| eval name=mvindex(split(name,".PSPV"),0)
| eval id=mvindex(split(name," - "),0)
| search id IN (*)
| eval main=mvindex(split(name," - "),1)
| search main IN (*)
| stats count(eval(sta="FIL")) as fail_count, count(eval(sta="PASS")) as pass_count, count(eval(like(sta,"LOCKED%"))) as not_run_count by name,id

--------------------------------------------------------------------
selected date is from 1jan 2024 to 13 jan 2024

index="bsds_gans" earliest=1704096000 latest=+1d pfor IN (*) test IN (*) name IN (*) ckb IN (*) vrsion IN (*) id IN (*) location IN (*) group IN (*)

| eval pfor=upper(pfor)
| eval _time = start_time
| eval WW=strftime(_time, "%V.%w")
| eval name=mvindex(split(context,"."),1)
| search name !="*Case Setup*"
| eval name=mvindex(split(name,".PSPV"),0)
| eval id=mvindex(split(name," - "),0)
| search id IN (*)
| eval main=mvindex(split(name," - "),1)
| search main IN (*)
| stats count(eval(sta="FIL")) as fail_count, count(eval(sta="PASS")) as pass_count, count(eval(like(sta,"LOCKED%"))) as not_run_count by name,id
-----------------------------------------------------------------------
selected  for last 7 days

index="bsds_gans" earliest=-7d@h latest=+1d pfor IN (*) test IN (*) name IN (*) ckb IN (*) version IN (*) id IN (*) location IN (*) group IN (*)

| eval pfor=upper(pfor)
| eval _time = start_time
| eval WW=strftime(_time, "%V.%w")
| eval name=mvindex(split(context,"."),1)
| search name !="*Case Setup*"
| eval name=mvindex(split(name,".PSPV"),0)
| eval id=mvindex(split(name," - "),0)
| search id IN (*)
| eval main=mvindex(split(name," - "),1)
| search main IN (*)
| stats count(eval(sta="FIL")) as fail_count, count(eval(sta="PASS")) as pass_count, count(eval(like(sta,"LOCKED%"))) as not_run_count by name,id

[ITWhisperer]

The earliest and latest settings in the search are overriding the values chosen from the timepicker and since these are the same, the numbers in your panels are the same.

[ramkyreddy]

The numbers in the panels are the same when trying different time ranges as I mentioned in the above search query

[ITWhisperer]

It is not clear what searches are giving what results - you mentioned 3 searches, but showed only two sets of panels. All the searches you have shown use earliest and latest settings which override anything you have chosen in the timepicker, so it is not clear which timeperiods have been used for which sets of panels. Please clarify