Splunk Enterprise

How to search from 600 seconds before to 600 seconds after the time specified in the time picker on the dashboard?

Msugiyama
Path Finder

I would like to search from 600 seconds before to 600 seconds after the time specified in the time picker on the dashboard. Is there a good idea?

The time picker is also used in another panel, so it is in response to the request that I didn't want to place multiple time pickers.

=== This SPL did not pass. ===
index = _internal
earliest = $ field1.earliest $ --600
latest = $ field1.earliest $ + 600

Labels (1)
0 Karma

Msugiyama
Path Finder

This is awesome!!
Resolved. Thanks!

I will relearn about TOKEN.

0 Karma

Msugiyama
Path Finder

Thank you for reply
What you want to search is the log related to the input to the form of the web page.

When "Today" is specified in the time picker
I can't search for a start and end if started a session at 23:50 yesterday and the session expires at 0:10 today.
For the time being, I would like to set up a buffer for about 10 minutes.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<form>
  <label>Time Picker token</label>
  <init>
    <eval token="earliest10minutesbefore">relative_time(now(),"-10m")</eval>
    <eval token="latest10minutesafter">relative_time(now(),"+10m")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="time" token="time" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
      <change>
        <condition>
          <eval token="earliest10minutesbefore">relative_time(relative_time(now(),$time.earliest$),"-10m")</eval>
          <eval token="latest10minutesafter">relative_time(relative_time(now(),$time.latest$),"+10m")</eval>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>10 minute buffer</title>
      <table>
        <search>
          <query>| makeresults
| eval earliest10minutesbefore= $earliest10minutesbefore$,
latest10minutesafter=$latest10minutesafter$
| eval earliest_time=strftime(earliest10minutesbefore,"%Y-%m-%dT%H:%M:%S"),
latest_time=strftime(latest10minutesafter,"%Y-%m-%dT%H:%M:%S")
| table earliest_time, latest_time, earliest10minutesbefore, latest10minutesafter
| fields - _time</query>
          <earliest>$earliest10minutesbefore$</earliest>
          <latest>$latest10minutesafter$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

ITWhisperer
SplunkTrust
SplunkTrust

You could add a change handler to the timepicker to evaluate new tokens based on the values chosen and use those new tokens for your earliest and latest values.

Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...