Your requirement isn't really clear. Not to point to the obvious difference between last (set in first panel) and $latest$ (used in second panel), but are you sure you can even add an additional field in the first panel and still maintain your original timechart? (Hint: It will ruin it all; at least it will distort the chart.) Another important question is: What is that $latest$ expected supposed to be? It seems that you want it to be the interactive token because you set it according to _time which varies by row. I already mentioned that setting a new field after timechart will ruin your chart. But in addition, Dashboard Studio has its own regiment to manage tokens. You cannot set a variable in one search and call that variable with $$ and expect it to be a passable token. This is the document about setting interactive token with search result: Setting tokens from search results or search job metadata. Then, to add 1 week to the click value, run that result in another search. (Just like you would do in Simple XML.) Lastly, use result from that search to drive the second panel. Here is an example: {
"visualizations": {
"viz_7yE1ZwsT": {
"type": "splunk.line",
"dataSources": {
"primary": "ds_DmIKSSCN"
},
"title": "First panel",
"eventHandlers": [
{
"type": "drilldown.setToken",
"options": {
"tokens": [
{
"token": "latest_tok",
"key": "row._time.value"
}
]
}
}
],
"options": {
"legendDisplay": "top"
}
},
"viz_OIqDnl0b": {
"type": "splunk.line",
"options": {
"legendDisplay": "bottom"
},
"dataSources": {
"primary": "ds_79fdaiuf"
},
"showProgressBar": false,
"showLastUpdated": false
}
},
"dataSources": {
"ds_DmIKSSCN": {
"type": "ds.search",
"options": {
"query": "| tstats count where index=_internal by _time span=1d sourcetype\n| timechart span=1d sum(count) by sourcetype\n| eval _last = relative_time(_time, \"+1w\")"
},
"name": "first panel"
},
"ds_79fdaiuf": {
"type": "ds.search",
"options": {
"query": "index=_introspection latest=$make token:result.week_after$\n| timechart span=1d count by sourcetype"
},
"name": "dependent panel"
},
"ds_EHm1QhZI": {
"type": "ds.search",
"options": {
"query": "| makeresults\n| eval week_after = relative_time($latest_tok$, \"+1w\")",
"enableSmartSources": true
},
"name": "make token"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
}
}
}
}
},
"inputs": {
"input_global_trp": {
"type": "input.timerange",
"options": {
"token": "global_time",
"defaultValue": "-3w@w,now"
},
"title": "Global Time Range"
}
},
"layout": {
"type": "grid",
"options": {
"width": 1440,
"height": 960
},
"structure": [
{
"item": "viz_7yE1ZwsT",
"type": "block",
"position": {
"x": 0,
"y": 0,
"w": 1440,
"h": 400
}
},
{
"item": "viz_OIqDnl0b",
"type": "block",
"position": {
"x": 0,
"y": 400,
"w": 1440,
"h": 400
}
}
],
"globalInputs": [
"input_global_trp"
]
},
"description": "https://community.splunk.com/t5/Splunk-Search/Dashboard-Studio-earliest-latest-tokens/m-p/691740",
"title": "Pass time token"
} In this dashboard, when you click a point on July 13 in the first panel, the second panel will end on July 20. Is this something you are looking at?
... View more
