Splunk Search

Problem with token eval I am trying to rest one hour to fiel1latest

rutdesanti
New Member

What I am doing wrong, I am trying to rest one hour to fiel1latest

    <label>otro</label>
  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Timepicker</label>
      <default><done>
        <eval token="newtime">$$field1.latest$$,"-1@h"</eval></done>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>ind
| stats count by _time</query>
          <earliest>$$newtime$$</earliest>
          <latest>$$field1.latest$$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
Tags (1)
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @rutdesanti

I made some minor changes and this is working for me :

  <fieldset submitButton="true">
    <input type="time" token="field1">
      <label>Timepicker</label>
      <default>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=int_gcg_mex_accimarket_151486
 | stats count by _time</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>

Does it do what you want?

0 Karma

rutdesanti
New Member

Can you please delete the index

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...