@ygdrassil, please try the the following run anywhere dashboard which uses a dummy search to pick the selected Time input's Earliest Time using predefined search token $job.earliestTime$ (in string time format) and uses <eval> with relative_time and strptime to get earliest time ( $subSearchEarliest$ ) for sub search as the current day 4 weeks ago -4w@d (if you need start of week 4 weeks ago it would be -4w@0w ) and for latest time ( $subSearchLatest$ ) select previous day based on earliest time using -1d@d . Please try the run anywhere dashboard and confirm. <form> <label>Time for subsearch from same timepicker</label> <search> <query>| makeresults </query> <earliest>$tokTime.earliest$</earliest> <latest>$tokTime.latest$</latest> <progress> <eval token="subSearchEarliest">relative_time(strptime($job.earliestTime$,"%Y/%m/%dT%H:%M:%S"),"-4w@w0")</eval> <eval token="subSearchLatest">relative_time(strptime($job.earliestTime$,"%Y/%m/%dT%H:%M:%S"),"-1d@d")</eval> </progress> </search> <fieldset submitButton="false"> <input type="time" token="tokTime" searchWhenChanged="true"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <query>index=_internal sourcetype=splunkd earliest=$subSearchEarliest$ latest="$subSearchLatest$" | stats count by log_level | append [|makeresults| fields - _time| eval log_level="INFO",count=0] | dedup log_level | eval subSearchEarliestTime=strftime($subSearchEarliest$,"%Y/%m/%d %H:%M:%S"), subLatestTime=strftime($subSearchLatest$,"%Y/%m/%d %H:%M:%S")</query> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">0</option> </table> </panel> </row> </form> PS: Commands | append [|makeresults| fields - _time| eval log_level="INFO",count=0] | dedup log_level have been added to return at least one row for the demo query to run in case there is no data in _internal index from 4 weeks ago. ... View more

@ygdrassil, please go ahead and mention your approach to fix the issue and Accept the same as answer. In your question you have first mentioned that you are interested in digits after S and then also digits after dot (.) <YourBaseSearch> yourFieldName=* | rex field=yourFieldName "S(?<firstField>[^-]+)-(?<secondField>\d+)" If the field value is present on the events you are interested in and you always need this extraction you should check out Field Extraction Knowledge Objects (this way the regular expression based field extraction will persist as Knowledge Object and can be easily maintained and reused.). Following are some of Splunk Documentation reference for the same: http://docs.splunk.com/Documentation/SplunkCloud/latest/Search/Extractfieldswithsearchcommands http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutfields Following is a run anywhere search based on sample data provided: | makeresults | eval yourFieldName="S01-3101,S01-301" | makemv yourFieldName delim="," | mvexpand yourFieldName | rex field=yourFieldName "S(?<firstField>[^-]+)-(?<secondField>\d+)" ... View more