I've setup a dashboard based on charting trade queue information for our application which we are ingesting using a dbconnect SQL query. I have one chart that is using the global_time picker for earliest and latest time values, I have another chart below it that I want to show for the same period of the previous business day. I've tried the following two queries in the Data Source for the Previous Business Day chart but not getting any results: Attempt 1: index=prod_db sourcetype=dbconnect source=TradeStats [| makeresults count=1 | eval earliest=if(strftime(now(),"%a")="Mon",relative_time("$global_time.earliest$", "-3d"),relative_time("$global_time.earliest$", "-1d")) | eval latest=if(strftime(now(),"%a")="Mon",relative_time("$global_time.latest$", "-3d"),relative_time("$global_time.latest$", "-1d")) | table earliest latest | format ] | timechart sum(TradeCount) as Processed, latest(TradeQueue) as Queued latest(TradeQueueLatencyMins) as QueueLatencyMins span=1m partial=false Attempt 2: index=prod_db sourcetype=dbconnect source=TradeStats [| makeresults count=1 | eval offsetdays=if(strftime(now(),"%a")="Mon","-3d","-1d") | eval earliest=relative_time(earliest, offsetdays) | eval latest=relative_time(latest, offsetdays) | table earliest latest | format ] | timechart sum(TradeCount) as Processed, latest(TradeQueue) as Queued latest(TradeQueueLatencyMins) as QueueLatencyMins span=1m partial=false In attempt 1 i was just trying $global_time.earliiest$ without the quotation marks but kept getting evalcommand malformed, missing ). I tried various ways to escape the $ sign (tried $$) Basically if I change the global time picker for the chart of current day, I want this to cascade to the next chart. Just doesn't seem to want to work. Only if I hard code the time period in the search. Note I am using this code block in the dashboard code: "defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"latest": "$global_time.latest$",
"earliest": "$global_time.earliest$"
},
"refresh": "120s"
}
}
}
},
... View more
