Hi @wodrog Would something like this work for you? This uses a hidden search/table to generate the earliest/latest for the previous day based on the input and then uses that in the earliest/latest for the search. {
"title": "Answers-SearchPreviousDay",
"description": "",
"inputs": {
"input_zIorjrMc": {
"options": {
"defaultValue": "-24h@h,now",
"token": "tr_global"
},
"title": "Main Time Selector",
"type": "input.timerange"
}
},
"defaults": {
"dataSources": {
"ds.o11y": {
"options": {
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
}
},
"ds.search": {
"options": {
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
}
}
}
},
"visualizations": {
"viz_5ZrDUHwo": {
"containerOptions": {},
"dataSources": {
"primary": "ds_zdaUZXdL"
},
"eventHandlers": [
{
"options": {
"tokens": [
{
"key": "row.info_min_time.value",
"token": "eventid"
}
]
},
"type": "drilldown.setToken"
}
],
"options": {
"stackMode": "stacked"
},
"showLastUpdated": false,
"showProgressBar": false,
"title": "This shows for time selected in picker",
"type": "splunk.column"
},
"viz_BcDlqy4I": {
"options": {
"markdown": "Earliest = $globalTimeSpl:result.earliest$ \nLatest = $globalTimeSpl:result.latest$"
},
"type": "splunk.markdown"
},
"viz_NgmH6lHI": {
"containerOptions": {},
"dataSources": {
"primary": "ds_BlYVOfBA"
},
"eventHandlers": [
{
"options": {
"tokens": [
{
"key": "row.info_min_time.value",
"token": "eventid"
}
]
},
"type": "drilldown.setToken"
}
],
"options": {
"stackMode": "stacked"
},
"showLastUpdated": false,
"showProgressBar": false,
"title": "This shows for time selected - 24 hours",
"type": "splunk.column"
},
"viz_zUx2Zt29": {
"dataSources": {
"primary": "ds_ZKBDXZy2_ds_BlYVOfBA"
},
"type": "splunk.table"
}
},
"dataSources": {
"ds_BlYVOfBA": {
"name": "global",
"options": {
"query": "| tstats count where index=main earliest=$globalTimeSpl:result.earliest$ latest=$globalTimeSpl:result.latest$ by _time, host span=15m\n| timechart span=15m sum(count) as count by host",
"queryParameters": {
"earliest": "$tr_global.earliest$",
"latest": "$tr_global.latest$"
}
},
"type": "ds.search"
},
"ds_ZKBDXZy2_ds_BlYVOfBA": {
"name": "globalTimeSpl",
"options": {
"enableSmartSources": true,
"query": "| makeresults \n| addinfo\n| eval earliest=info_min_time-86400\n| eval latest=info_max_time-86400",
"queryParameters": {
"earliest": "$tr_global.earliest$",
"latest": "$tr_global.latest$"
}
},
"type": "ds.search"
},
"ds_aOEeGNWG": {
"name": "Search_1",
"options": {
"query": "| tstats count WHERE index=_internal by host"
},
"type": "ds.search"
},
"ds_ccCiW2S8": {
"name": "tstat",
"options": {
"query": "| tstats count where index=_internal by _time span=1h",
"queryParameters": {
"earliest": "$tr_global.earliest$",
"latest": "$tr_global.latest$"
}
},
"type": "ds.search"
},
"ds_gRgnjURi": {
"name": "Search_3",
"options": {
"query": "| tstats count where index=_internal by source, host"
},
"type": "ds.search"
},
"ds_rt307Czb": {
"name": "timeSPL",
"options": {
"enableSmartSources": true,
"query": "| makeresults \n| addinfo",
"queryParameters": {
"earliest": "-60m@m",
"latest": "now"
}
},
"type": "ds.search"
},
"ds_thns3Lsu": {
"name": "Search_2",
"options": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$",
"o11yDSType": "serviceMap",
"services": [
"paymentservice"
]
},
"type": "ds.o11y"
},
"ds_zdaUZXdL": {
"name": "CurrentPickerTime",
"options": {
"query": "| tstats count where index=main by _time, host span=15m\n| timechart span=15m sum(count) as count by host",
"queryParameters": {
"earliest": "$tr_global.earliest$",
"latest": "$tr_global.latest$"
}
},
"type": "ds.search"
}
},
"layout": {
"globalInputs": [
"input_zIorjrMc"
],
"layoutDefinitions": {
"layout_1": {
"options": {
"display": "auto",
"height": 960,
"width": 1440
},
"structure": [
{
"item": "viz_NgmH6lHI",
"position": {
"h": 270,
"w": 1390,
"x": 10,
"y": 350
},
"type": "block"
},
{
"item": "viz_BcDlqy4I",
"position": {
"h": 50,
"w": 300,
"x": 20,
"y": 10
},
"type": "block"
},
{
"item": "viz_zUx2Zt29",
"position": {
"h": 100,
"w": 680,
"x": 1470,
"y": 10
},
"type": "block"
},
{
"item": "viz_5ZrDUHwo",
"position": {
"h": 270,
"w": 1390,
"x": 10,
"y": 60
},
"type": "block"
}
],
"type": "absolute"
}
},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
},
"applicationProperties": {
"collapseNavigation": true,
"hideEdit": false,
"hideExport": false,
"hideOpenInSearch": false
}
} 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing
... View more
