Yes - clearing my browser cache worked for me on upgrade from 3.2 to 3.13. ... View more

This worked for me!! I updated the script in 3.2 as you suggested. ... View more

Hi @iamsplunker31, you're right, my answer was lacking. I made some edits to account for the different time ranges needed throughout the search. Does this help? ... View more

Hi @iamsplunker31, you'll want to add a time picker for the user to be able to choose the day. Then you can explicitly reference the time picker using the tokens, but add relative time modifiers after each token as needed, like this. <form> <label>Test Search</label> <fieldset submitButton="false"> <input type="time" token="time"> <label></label> <default> <earliest>-d@d</earliest> <latest>@d</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <query>index=foo sourcetype=xyz | bin _time span=5m | stats dc(ecn) as Current by _time | appendcols [search index=foo sourcetype=xyz earliest=$time.earliest$-7d@d latest=$time.latest$-7d@d | bin _time span=5m | stats dc(ecn) as LastWeek by _time] | appendcols [search index=foo sourcetype=xyz earliest=$time.earliest$-14d@d latest=$time.latest$-14d@d | bin _time span=5m | stats dc(ecn) as TwoWeeksAgo by _time] | appendcols [search index=foo sourcetype=xyz earliest=$time.earliest$-21d@d latest=$time.latest$-21d@d | bin _time span=5m | stats dc(ecn) as ThreeWeeksAgo by _time] | appendcols [search index=foo sourcetype=xyz earliest=$time.earliest$-28d@d latest=$time.latest$-28d@d | bin _time span=5m | stats dc(ecn) as FourWeeksAgo by _time] | eval AvgOfFourWeeks=(LastWeek+TwoWeeksAgo+ThreeWeeksAgo+FourWeeksAgo)/4 | eval Diff1=LastWeek-Current | eval Diff2=AvgOfFourWeeks-Current | eval Est_Impact= Diff1-Diff2</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> This is the simplest option. You could improve on the efficiency of this search by combining the appendcols into a single base search. However, you'd have to use streamstats or some other way to differentiate between the weeks so you can do math between them. I'll think on this one some more. ... View more

Hi @kishan2356, this code worked for me when I pasted it into an empty dashboard. It is assumed that the user enters relative time modifiers for earliest and latest times. Additional code would have to be added to account for different ways the user might use the time input, such as epoch time values, use of "now", etc. This uses a subsearch to pull last weeks data. So the search uses the time input values and the subsearch uses modified time input values. <form> <label></label> <fieldset submitButton="false"> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <query>index=some_index | stats count | addinfo | eval info_min_time_string=strftime(info_min_time,"%Y-%m-%d %H:%M:%S") | eval info_max_time_string=strftime(info_max_time,"%Y-%m-%d %H:%M:%S") | eval time_input_min_time_string=strftime(relative_time(now(),$field1.earliest|s$),"%Y-%m-%d %H:%M:%S") | fields time_input_min_time_string info_min_time_string info_max_time_string count | append [search index=some_index earliest=$field1.earliest$-7d latest=$field1.latest$-7d | stats count | addinfo | eval info_min_time_string=strftime(info_min_time,"%Y-%m-%d %H:%M:%S") | eval info_max_time_string=strftime(info_max_time,"%Y-%m-%d %H:%M:%S") | eval time_input_min_time_string=strftime(relative_time(now(),$field1.earliest|s$),"%Y-%m-%d %H:%M:%S") | fields time_input_min_time_string info_min_time_string info_max_time_string count]</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> ... View more