Okay @datachacha Ive been having a good think about this and I dont think I have an elegant solution - but I think I do have *a* solution: This uses a hidden token/text box to the side and a s...
See more...
Okay @datachacha Ive been having a good think about this and I dont think I have an elegant solution - but I think I do have *a* solution: This uses a hidden token/text box to the side and a search to determine the _time+2hours. You can then use this in your other queries as earliest/latest as per the sample event on the dashboard using `$globalTimeSpl:results.earliest$` and `$globalTimeSpl:results.latest$` Here is the full JSON to have a play around with - does this do what you need? {
"title": "testing",
"description": "",
"inputs": {
"input_MPUmpGoR": {
"options": {
"defaultValue": "DEFAULT",
"token": "calc_earliest"
},
"title": "Earliest",
"type": "input.text"
},
"input_zIorjrMc": {
"options": {
"defaultValue": "-24h@h,now",
"token": "tr_global"
},
"title": "Main Time Selector",
"type": "input.timerange"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
}
}
}
},
"visualizations": {
"viz_BcDlqy4I": {
"options": {
"markdown": "Earliest = $globalTimeSpl:result.earliest$ \nLatest = $globalTimeSpl:result.latest$"
},
"type": "splunk.markdown"
},
"viz_NgmH6lHI": {
"dataSources": {
"primary": "ds_BlYVOfBA"
},
"title": "This shows for time selected + 2hours",
"type": "splunk.table"
},
"viz_Nqdf4h2p": {
"dataSources": {
"primary": "ds_ccCiW2S8"
},
"eventHandlers": [
{
"options": {
"tokens": [
{
"key": "row._time.value",
"token": "calc_earliest"
}
]
},
"type": "drilldown.setToken"
}
],
"type": "splunk.column"
},
"viz_zUx2Zt29": {
"dataSources": {
"primary": "ds_ZKBDXZy2_ds_BlYVOfBA"
},
"type": "splunk.table"
}
},
"dataSources": {
"ds_BlYVOfBA": {
"name": "global",
"options": {
"query": "index=_internal earliest=$globalTimeSpl:result.earliest$ latest=$globalTimeSpl:result.latest$ \n| addinfo \n| head 1\n| table info* _raw"
},
"type": "ds.search"
},
"ds_ZKBDXZy2_ds_BlYVOfBA": {
"name": "globalTimeSpl",
"options": {
"enableSmartSources": true,
"query": "| makeresults \n| addinfo\n| eval earliest=IF($calc_earliest|s$!=\"DEFAULT\",$calc_earliest|s$,info_min_time)\n| eval latest=IF($calc_earliest|s$!=\"DEFAULT\",$calc_earliest$+7200, info_max_time)",
"queryParameters": {
"earliest": "$tr_global.earliest$",
"latest": "$tr_global.latest$"
}
},
"type": "ds.search"
},
"ds_ccCiW2S8": {
"name": "tstat",
"options": {
"query": "| tstats count where index=_internal by _time span=1h",
"queryParameters": {
"earliest": "$tr_global.earliest$",
"latest": "$tr_global.latest$"
}
},
"type": "ds.search"
},
"ds_rt307Czb": {
"name": "timeSPL",
"options": {
"enableSmartSources": true,
"query": "| makeresults \n| addinfo",
"queryParameters": {
"earliest": "-60m@m",
"latest": "now"
}
},
"type": "ds.search"
}
},
"layout": {
"globalInputs": [
"input_zIorjrMc"
],
"layoutDefinitions": {
"layout_1": {
"options": {
"display": "auto",
"height": 960,
"width": 1440
},
"structure": [
{
"item": "viz_Nqdf4h2p",
"position": {
"h": 300,
"w": 1390,
"x": 10,
"y": 210
},
"type": "block"
},
{
"item": "viz_NgmH6lHI",
"position": {
"h": 140,
"w": 1390,
"x": 10,
"y": 60
},
"type": "block"
},
{
"item": "viz_BcDlqy4I",
"position": {
"h": 50,
"w": 300,
"x": 20,
"y": 10
},
"type": "block"
},
{
"item": "input_MPUmpGoR",
"position": {
"h": 82,
"w": 198,
"x": 1470,
"y": 50
},
"type": "input"
},
{
"item": "viz_zUx2Zt29",
"position": {
"h": 100,
"w": 680,
"x": 1470,
"y": 130
},
"type": "block"
}
],
"type": "absolute"
}
},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
}
} Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing