I have a requirement to hide the results from a panel until search is not complete.  WHen I am using below, it is hiding the panel until result is not coming.    Can you please suggest how can I see the pannel but, not the results until search is not complete.  <panel depends="$hide_progress_panel$"> <table> <search> <query>index="_internal" |table *</query> <earliest>-30d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> <progress> <unset token="hide_progress_panel"></unset> </progress> <done> <set token="hide_progress_panel">true</set> </done> ... View more

It sounds like you want to use the value of your manager input token in the search that generates the results for the transaction input. I can't tell you how exactly to do it on your dashboard since I don't have your code, but it involves having the manager token in the query of the transaction input, the same way you have it in the main search that creates your results (table or view or whatever you got). You need to make sure that the tokens work in both searches of course. ... View more

Hi @ivanreis. Thank you for your resposnse. I already looked at those Splunk Answers but I'm looking for a solution something specific to my issue ... View more

index=foo id=ABCDE env=PROD sourcetype="bar" [| makeresults count=2 | streamstats count | addinfo | eval earliest=if(count==2,relative_time(info_min_time,"-7d"),info_min_time) | eval latest=if(count==2,relative_time(info_max_time,"-7d"),info_max_time) | table earliest latest | format "" "(" "" ")" "OR" ""] | addinfo | eval label=if(strftime(_time,"%d")==strftime(info_max_time,"%d"),"Customer_Count_Today","Customer_Count_LastWeek") | bin _time span=30m | chart dc(kbps) over _time by label | fields _time Customer_Count_Today Customer_Count_LastWeek Hi, please use the time picker. Search one week before that time interval. ... View more

Hi @vnravikumar, Thank you for your response. The start time and end time works fine but our base search pulling the resullts for current, last 7 days ,14 days , 21 days , 28 days . If we select the start and end time say (10/13/2019 10:00 - 10/13/2019 11:00). It's pulling the results along with current, last 7 days , 14 days .. with the time period (10-11). We only need to pull the data for selected time period. Here is our base query | multisearch [ search index=foo sourcetype=bar earliest=-0d@d latest=now | eval label="Colomn1" | fields -_raw _time apple label ] [ search index=foo sourcetype=bar earliest=-7d@d latest=-7d@d | eval _time=_time+60*60*24*7 | eval label="Colomn2" | fields -_raw _time apple label ] [ search index=foo sourcetype=bar earliest=-14d@d latest=-14d@d | eval _time=_time+60*60*24*14 | eval label="Colomn3" | fields -_raw _time apple label ] [ search index=foo sourcetype=bar earliest=-21@d latest=-21@d | eval _time=_time+60*60*24*21 | eval label="Colomn4" | fields -_raw _time apple label ] [ search index=foo sourcetype=bar earliest=-28@d latest=-28@d | eval _time=_time+60*60*24*28 | eval label="Colomn5" | fields -_raw _time apple label] | bin _time span=5m | chart dc(apple) over _time by label | eval "Colomn1 4 Week Avg"=('Colomn2'+Colomn3+Colomn4+Colomn5)/4 | eval "Colomn2 4 Week Avg"=abs('Colomn2'-'Colomn1') | eval "Diff of Colomn1 and 4 Week Avg."=abs('Colomn5'-'Colomn1') | eval Est_Impact= abs('Diff of Colomn1 and Colomn2'-'Colomn5.') | fields _time "Colomn1" "Colomn2" "Colomn3" "Colomn4" "Colomn5" |search colomn1!=0 ... View more

Your approach seems very strange to me but in any case, you are missing dollar-signs, so like this: <eval token="earliestTime">if(isstr(earliest), relative_time(now(),earliest), earliest)</eval> <eval token="latestTime">if(isstr(latest), relative_time(now(),latest), latest)</eval> <eval token="earliestTime1">relative_time($earliestTime$,"-7d")</eval> <eval token="latestTime1">relative_time($latestTime$,"-7d")</eval> <eval token="earliestTime2">relative_time($earliestTime$,"-14d")</eval> <eval token="latestTime2">relative_time($latestTime$,"-14d")</eval> <eval token="earliestTime3">relative_time($earliestTime$,"-21d")</eval> <eval token="latestTime3">relative_time($latestTime$,"-21d")</eval> <eval token="earliestTime4">relative_time($earliestTime$,"-28d")</eval> <eval token="latestTime4">relative_time($latestTime$,"-28d")</eval> ... View more

thanks @ajunpkishore5 ... View more

Hi iamsplunker31 you're welcome! if this answer solves your problem, please accept and/or upvote it. Ciao and next time! Giuseppe ... View more

Excellent information - thank you everyone. ... View more