Splunk Enterprise

How to search from 600 seconds before to 600 seconds after the time specified in the time picker on the dashboard?

Msugiyama
Path Finder

I would like to search from 600 seconds before to 600 seconds after the time specified in the time picker on the dashboard. Is there a good idea?

The time picker is also used in another panel, so it is in response to the request that I didn't want to place multiple time pickers.

=== This SPL did not pass. ===
index = _internal
earliest = $ field1.earliest $ --600
latest = $ field1.earliest $ + 600

Labels (1)
0 Karma

Msugiyama
Path Finder

This is awesome!!
Resolved. Thanks!

I will relearn about TOKEN.

0 Karma

Msugiyama
Path Finder

Thank you for reply
What you want to search is the log related to the input to the form of the web page.

When "Today" is specified in the time picker
I can't search for a start and end if started a session at 23:50 yesterday and the session expires at 0:10 today.
For the time being, I would like to set up a buffer for about 10 minutes.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<form>
  <label>Time Picker token</label>
  <init>
    <eval token="earliest10minutesbefore">relative_time(now(),"-10m")</eval>
    <eval token="latest10minutesafter">relative_time(now(),"+10m")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="time" token="time" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
      <change>
        <condition>
          <eval token="earliest10minutesbefore">relative_time(relative_time(now(),$time.earliest$),"-10m")</eval>
          <eval token="latest10minutesafter">relative_time(relative_time(now(),$time.latest$),"+10m")</eval>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>10 minute buffer</title>
      <table>
        <search>
          <query>| makeresults
| eval earliest10minutesbefore= $earliest10minutesbefore$,
latest10minutesafter=$latest10minutesafter$
| eval earliest_time=strftime(earliest10minutesbefore,"%Y-%m-%dT%H:%M:%S"),
latest_time=strftime(latest10minutesafter,"%Y-%m-%dT%H:%M:%S")
| table earliest_time, latest_time, earliest10minutesbefore, latest10minutesafter
| fields - _time</query>
          <earliest>$earliest10minutesbefore$</earliest>
          <latest>$latest10minutesafter$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

ITWhisperer
SplunkTrust
SplunkTrust

You could add a change handler to the timepicker to evaluate new tokens based on the values chosen and use those new tokens for your earliest and latest values.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...