Hi Splunkers, I have a doubt about a custom app customization. For a customer, we created with Splunk Addon Builder a simple app to use as "container": every customization we perform, such as Correlation rules, reports and so on, is assigned to this app. So, in its first release, the app has no particular panel, features and so on; let's say that just "exist". To be clearer: if I login and open the app, what I see is  this: and that's totally fine, due we did not perform any kind of customizations. So now, the question is: if I want to include the search function inside this app, how I can achieve this? I mean, we want avoid, when when we need to perform a search, to go on Search and Reporting app; we would be able to perform searches inside our app. For now, we don't need panel with specific charts, based on particular query: we want simple to be able to use (if it is possible of course) the Search and Reporting app/its functionality inside our app.

Hi, I have  StartTime,EndTime "2023-12-05 05:30:00.0000000","2023-12-05 08:00:00.0000000" "2023-12-05 08:00:00.0000000","2023-12-05 09:30:00.0000000" "2023-12-05 10:28:00.0000000","2023-12-05 13:30:00.0000000" I need to visualize a column chart, with 3 columns (in this case) with height 1 (y axis). The width of the first column is between "2023-12-05 05:30:00.0000000","2023-12-05 08:00:00.0000000", second one between "2023-12-05 08:00:00.0000000","2023-12-05 09:30:00.0000000", the third between "2023-12-05 10:28:00.0000000","2023-12-05 13:30:00.0000000". The x axis should be the time. Attached example. Any idea, please?

I am querying a change in a value each week over last 4 weeks. Ineed to know the value from the week before the search window to work out the change correctly. index=ind sourcetype=src (type=instrument) earliest=-5w@w+1d latest=@w+1d | bucket _time span=7d | stats max(reading) as WeekMax by _time | streamstats current=f last(WeekMax) as LastWeekMax | eval WeekDelta = WeekMax - LastWeekMax | eval WeekDelta = if(WeekDelta < 0, 0.000000, WeekDelta) | table _time, WeekMax, WeekDelta I don't want to show the time for the week before the query (-5th week). Any tips on how to change this query to only show results for last 4 weeks but still calculating the change correctly?   Thanks

I basically have the exact same question as https://community.splunk.com/t5/Dashboards-Visualizations/How-to-have-a-panel-use-an-offset-from-a-time-picker/m-p/351003.   BUT I need to actually change the value in the timerange picker token. E.G. if i select a timerange of "last 4 hour" and my modification is to add an hour, than the $token_time.earliest$ should not be  "-4h" but "-5h".