Splunk Enterprise

How to search from 600 seconds before to 600 seconds after the time specified in the time picker on the dashboard?

Msugiyama
Path Finder

I would like to search from 600 seconds before to 600 seconds after the time specified in the time picker on the dashboard. Is there a good idea?

The time picker is also used in another panel, so it is in response to the request that I didn't want to place multiple time pickers.

=== This SPL did not pass. ===
index = _internal
earliest = $ field1.earliest $ --600
latest = $ field1.earliest $ + 600

0 Karma

Msugiyama
Path Finder

This is awesome!!
Resolved. Thanks!

I will relearn about TOKEN.

0 Karma

Msugiyama
Path Finder

Thank you for reply
What you want to search is the log related to the input to the form of the web page.

When "Today" is specified in the time picker
I can't search for a start and end if started a session at 23:50 yesterday and the session expires at 0:10 today.
For the time being, I would like to set up a buffer for about 10 minutes.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<form>
  <label>Time Picker token</label>
  <init>
    <eval token="earliest10minutesbefore">relative_time(now(),"-10m")</eval>
    <eval token="latest10minutesafter">relative_time(now(),"+10m")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="time" token="time" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
      <change>
        <condition>
          <eval token="earliest10minutesbefore">relative_time(relative_time(now(),$time.earliest$),"-10m")</eval>
          <eval token="latest10minutesafter">relative_time(relative_time(now(),$time.latest$),"+10m")</eval>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>10 minute buffer</title>
      <table>
        <search>
          <query>| makeresults
| eval earliest10minutesbefore= $earliest10minutesbefore$,
latest10minutesafter=$latest10minutesafter$
| eval earliest_time=strftime(earliest10minutesbefore,"%Y-%m-%dT%H:%M:%S"),
latest_time=strftime(latest10minutesafter,"%Y-%m-%dT%H:%M:%S")
| table earliest_time, latest_time, earliest10minutesbefore, latest10minutesafter
| fields - _time</query>
          <earliest>$earliest10minutesbefore$</earliest>
          <latest>$latest10minutesafter$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

ITWhisperer
SplunkTrust
SplunkTrust

You could add a change handler to the timepicker to evaluate new tokens based on the values chosen and use those new tokens for your earliest and latest values.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...