It's a bit long, hope i will not bore you. I made a splunk graph with two lines 🙂 I need to see the values compared to the average of the last 10 days. So: One line is the percentage between a time period, let's say Today 28 Jan 14:20 --> 14:25 Second line is the average percentage between the same time period but for last 10 days, 18-27 Jan 14:20 --> 14:25 What i can tell by looking at this graph is stuff like , "Today at 14:20 we had x% more/less than the last 10 day average, but at 14:21 we had x% more/less " etc. It's important to always have time snapped at the start of the minute (so if "now" is 17:31:23 then last minute is 17:30:00.000 --> 17:30:59.999) To make the search for this graph, i am using ealiest= and latest= like this: index=logs earliest=-5m@m latest =-1m@m | .... | append [search index=logs ( (earliest=24h-5m@m AND latest=-24h-1m@m) OR (earliest=-48h-5m@m AND latest=-48h-1m@) OR ... ) | ... ] | ... The search itself works ok, but my problem is when i try to make a dashboard for it. The dashboard needs to contain a time input with a token I named "thetime" 🙂 Usually, you make the dashboard search use this time input by selecting "Shared Time picker (thetime)". This is not possible for my search, so i need somehow to specify $thetime.earliest$ / $thetime.latest$ in the search query. But i cannot just simply do something straight forward like: index=logs earliest=$thetime.earliest$ latest=$thetime.latest$-24h@m | ... Depending one what i select in the time picker, i can end up with messages like: Invalid value "now-24h" for time term 'latest' I know about | addinfo https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Addinfo but it's impossible to use "info_max_time" in the first part of the searches, only after the pipe addinfo. Add even if it did somehow, there would still be the issue of the required minute snap to 00 --> 59 seconds. My approach, was to use the the <init> part of the dashboard xml to calculate all the needed earliest/latest. Currently i am dealing only with relative ranges, will deal with exact dates (between) later. So in my dashboard xml i have this: <form version="1.1" theme="light"> <init> <eval token="RSTART">strftime(relative_time(now(), $thetime.earliest$),"%Y-%m-%d %H:%M:00")</eval> <eval token="REND">strftime(relative_time(now(), $thetime.latest$),"%Y-%m-%d %H:%M:00")</eval> </init> ... <query>index=logs | eval RRSTART="$RSTART$", RREND="$REND$" | table _time, RRSTART, RREND</query> ... </form> The following part drives me crazy. Assuming now is 17:55:02. I am accessing the splunk board that has this link: https://splunk-self-hosted/en-US/app/search/DASHBOARD_NAME When i first load the page, i see the time picker and a submit button. There are no results shown until i press submit. I select "Relative" , earliest 1 Hours ago, "No snap-to", latest now, apply and submit. The browser URL changes to https://splunk-self-hosted/en-US/app/search/DASHBOARD_NAME?form.thetime.earliest=-1h&form.thetime.latest=now and the results i get RRSTART RREND 2025-01-28 17:55:00 2025-01-28 17:55:00 (same values, bad) At this point, I just click the refresh button of the browser, and i get : RRSTART RREND 2025-01-28 16:55:00 2025-01-28 17:55:00 (correct values) So basically, if i always click submit and then reload, im get the correct values 🙂 From what i understand from https://docs.splunk.com/Documentation/Splunk/9.4.0/Viz/tokens#Set_tokens_on_page_load this should not happen. As for my questions : Can anyone tell me if i am doing something wrong with <init> ? Maybe it cannot be used this way with dashboard tokens ? Or maybe there is another way to do this without using <init> ? Thank you for taking the time to read. Using Splunk Enterprise Version: 9.1.0.2
... View more