Dashboards & Visualizations

How to use a token's earliest value in a query

bsg273
Path Finder

I have a dashboard with a timeframe dropdown created by a token called "query_time".  I'm trying to create a panel to show the availability of a given service/process over whatever period of time is selected in the "query_time" dropdown (I have my ps.sh running every 1800 seconds btw, hence the 1800 shown).  I thought it would be as simple as subtracting the two, as shown below, but I'm getting an error whenever I incorporate the $query_time.earliest$ into the query.  It seems to play nice if I were to use just $query_time.latest$ though.  Is there any way to get this time difference in the query without it erroring out?  Thanks in advance!

 

 

 

    <panel>
      <chart>
        <title>rhnsd Availability</title>
        <search>
          <query>index=os host="mydb1" sourcetype=ps rhnsd  | stats count | eval availability=count/(($query_time.latest$-$query_time.earliest$)/1800)*100) | fields availability</query>
          <earliest>$query_time.earliest$</earliest>
          <latest>$query_time.latest$</latest>
        </search>
        <option name="charting.axisY.maximumNumber">100</option>
        <option name="charting.chart">fillerGauge</option>
        <option name="charting.chart.rangeValues">[0,90,100]</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.gaugeColors">["0xdc4e41","0x53a051"]</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>

 

 

 

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
    <panel>
      <chart>
        <title>rhnsd Availability</title>
        <search>
          <query>
index=os host="mydb1" sourcetype=ps rhnsd
| stats count
| addinfo
| eval availability=count/((info_max_time-info_min_time)/1800)*100) 
| fields availability
          </query>
          <earliest>$query_time.earliest$</earliest>
          <latest>$query_time.latest$</latest>
        </search>
        <option name="charting.axisY.maximumNumber">100</option>
        <option name="charting.chart">fillerGauge</option>
        <option name="charting.chart.rangeValues">[0,90,100]</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.gaugeColors">["0xdc4e41","0x53a051"]</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
    <panel>
      <chart>
        <title>rhnsd Availability</title>
        <search>
          <query>
index=os host="mydb1" sourcetype=ps rhnsd
| stats count
| addinfo
| eval availability=count/((info_max_time-info_min_time)/1800)*100) 
| fields availability
          </query>
          <earliest>$query_time.earliest$</earliest>
          <latest>$query_time.latest$</latest>
        </search>
        <option name="charting.axisY.maximumNumber">100</option>
        <option name="charting.chart">fillerGauge</option>
        <option name="charting.chart.rangeValues">[0,90,100]</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.gaugeColors">["0xdc4e41","0x53a051"]</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...