Hi, Absolutely. You simply need to specifiy the earliest_time and latest_time as their epoch values. So for your example, you could do something like this in your times.conf : [my_custom_time] label = January 1st 2017 earliest_time = 1483228800 latest_time = 1483315199 If you want to work out epoch times, there are many online tools which you could use. Or, Splunk can always help you. Here's an example search, which you could change as required: | makeresults | fields - _time | eval t1="01/01/2017:00:00:00", t2="01/01/2017:23:59:59" | eval t1_epoch=strptime(t1,"%d/%m/%Y:%H:%M:%S"), t2_epoch=strptime(t2,"%d/%m/%Y:%H:%M:%S") I hope this helps. ... View more

And finally, This might be closer to what you want, but I'm pretty sure that it won't scale (if terms of configuration overhead) if you've got a lot of single panels. You can set an eval / case statement in each single panel search to set the 'range'. Again, this really is just a bit of a workaround to look at a different approach; probably not ideal for what you want. But paste it into a blank dashboard and see if it helps: <form> <label>Test - Single Value 2</label> <fieldset submitButton="false"> <input type="radio" searchWhenChanged="true" token="tok_level"> <label>Pick a Level to Display</label> <choice value="all">All</choice> <choice value="low">Healthy</choice> <choice value="medium">Warning</choice> <choice value="high">High</choice> <default>All</default> <change> <condition match=" $value$ == $single_1_result$ "> <set token="show_single_1">true</set> <unset token="show_single_2"></unset> <unset token="show_single_3"></unset> </condition> <condition match=" $value$ == $single_2_result$ "> <set token="show_single_2">true</set> <unset token="show_single_1"></unset> <unset token="show_single_3"></unset> </condition> <condition match=" $value$ == $single_3_result$ "> <set token="show_single_3">true</set> <unset token="show_single_1"></unset> <unset token="show_single_2"></unset> </condition> <condition match=" $value$ == &quot;all&quot; "> <set token="show_single_1">true</set> <set token="show_single_2">true</set> <set token="show_single_3">true</set> </condition> <condition> <unset token="show_single_1"></unset> <unset token="show_single_2"></unset> <unset token="show_single_3"></unset> </condition> </change> </input> </fieldset> <row> <panel> <single id="single_1" depends="$show_single_1$"> <search> <query> <![CDATA[| makeresults | eval test=30 | append [| makeresults | eval test=1 | eval _time=_time-86400] | timechart span=1d sum(test) as my_result | eventstats latest(my_result) as latest | eval level=case(latest<=30,"low",latest<=70,"medium",latest>=71,"high")]]> </query> <sampleRatio>1</sampleRatio> <done> <condition match=" $result.level$ == &quot;low&quot;"> <set token="single_1_result">low</set> </condition> <condition match=" $result.level$ == &quot;medium&quot;"> <set token="single_1_result">medium</set> </condition> <condition match=" $result.level$ == &quot;high&quot;"> <set token="single_1_result">high</set> </condition> </done> </search> <option name="colorBy">value</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="useColors">1</option> </single> <single id="single_2" depends="$show_single_2$"> <search> <query> <![CDATA[| makeresults | eval test=70 | append [| makeresults | eval test=1 | eval _time=_time-86400] | timechart span=1d sum(test) as my_result | eventstats latest(my_result) as latest | eval level=case(latest<=30,"low",latest<=70,"medium",latest>=71,"high")]]> </query> <sampleRatio>1</sampleRatio> <done> <condition match=" $result.level$ == &quot;low&quot;"> <set token="single_2_result">low</set> </condition> <condition match=" $result.level$ == &quot;medium&quot;"> <set token="single_2_result">medium</set> </condition> <condition match=" $result.level$ == &quot;high&quot;"> <set token="single_2_result">high</set> </condition> </done> </search> <option name="colorBy">value</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="useColors">1</option> </single> <single id="single_3" depends="$show_single_3$"> <search> <query> <![CDATA[| makeresults | eval test=101 | append [| makeresults | eval test=1 | eval _time=_time-86400] | timechart span=1d sum(test) as my_result | eventstats latest(my_result) as latest | eval level=case(latest<=30,"low",latest<=70,"medium",latest>=71,"high")]]> </query> <sampleRatio>1</sampleRatio> <done> <condition match=" $result.level$ == &quot;low&quot;"> <set token="single_3_result">low</set> </condition> <condition match=" $result.level$ == &quot;medium&quot;"> <set token="single_3_result">medium</set> </condition> <condition match=" $result.level$ == &quot;high&quot;"> <set token="single_3_result">high</set> </condition> </done> </search> <option name="colorBy">value</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="useColors">1</option> </single> </panel> </row> <row> <panel> <title>Check Token for Condition</title> <html> <div>Token 'tok_level': $tok_level$</div> <hr></hr> <div>Token 'single_1_result': $single_1_result$</div> <div>Token 'single_2_result': $single_2_result$</div> <div>Token 'single_3_result': $single_3_result$</div> <hr></hr> <div>Token 'show_single_1': $show_single_1$</div> <div>Token 'show_single_2': $show_single_2$</div> <div>Token 'show_single_3': $show_single_3$</div> </html> </panel> </row> </form> ... View more

Ah, OK, I think I'm with you now. So you're driving your single panel elements with timechart , so that you can get a timeline. One option then, is to create another field in the search for these panels and use this in the conditional match, to set the panel depends token. So something like this: <search> <query>| makeresults | eval test=$tok_input$ | append [| makeresults | eval test=1 | eval _time=_time-86400] | timechart span=1d sum(test) as my_result | eventstats latest(my_result) as latest</query> <sampleRatio>1</sampleRatio> <done> <condition match=" $result.latest$ &gt; 100"> <set token="show_panel">true</set> </condition> <condition> <unset token="show_panel"></unset> </condition> </done> </search> Try that in the example above and see if it works for you. Then maybe adapt the logic to fit into your scenario. ... View more

Hi, Rather than trying to use the range colour, could you not use the field/value which is driving the colour? If you're search looked like this: | makeresults | fields - _time | eval test=101 | stats sum(test) as my_result You can access the value in the field my_result with $result.my_result$ In a condition block, you could use it like this to set a token for your depends panels: <done> <condition match=" $result.my_result$ > 100"> <set token="show_panel">true</set> </condition> <condition> <unset token="show_panel"></unset> </condition> </done> To see how that would look in a working example, you could paste this as source into a new Dashboard to play with: <form> <label>Test - Single Value</label> <fieldset submitButton="false"> <input type="radio" token="tok_input" searchWhenChanged="true"> <label>Pick a number</label> <choice value="10">10</choice> <choice value="51">51</choice> <choice value="101">101</choice> <default>10</default> </input> </fieldset> <row> <panel> <single> <search> <query>| makeresults | fields - _time | eval test=$tok_input$ | stats sum(test) as my_result</query> <sampleRatio>1</sampleRatio> <done> <condition match=" $result.my_result$ > 100"> <set token="show_panel">true</set> </condition> <condition> <unset token="show_panel"></unset> </condition> </done> </search> <option name="colorBy">value</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="useColors">1</option> </single> </panel> </row> <row> <panel> <title>Check Token for Condition</title> <html> <p>Token 'show_panel': $show_panel$</p> </html> </panel> </row> <row> <panel depends="$show_panel$"> <title>'Depends' Panel</title> <html> <h1>Only show me if result > 100</h1> </html> </panel> </row> </form> I'm not sure if that's exactly what you want, but it may give you a few more ideas. Example where value is <100 and colour is 'blue': Example where value is >100 and colour is 'red'. The additional panel is now shown: ... View more