Splunk Search

How do I get the time span (span=X) in a search to automatically adjust depending on the time picker value chosen?

praspai
Path Finder

Hi,

I want the time span in a search to adjust based upon the time picker value.

i.e.

time picker is day, then span=1h
month, then span=1d
year, then span=1month

thanks ..

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

| makeresults
| addinfo
| eval timepickerSpanSeconds=(info_max_time - info_min_time)
| eval spanToken=case(timepickerSpanSeconds>=31536000, "1m",
                      timepickerSpanSeconds>=604800,   "1d",
                      timepickerSpanSeconds<60,        "1s",
                      timepickerSpanSeconds<3600,      "1m",
                      true(),                          "1h")
| map search="search index=* earliest=$info_min_time$ latest=$info_max_time$ | timechart count span=$spanToken$ BY host"

View solution in original post

woodcock
Esteemed Legend

Like this:

| makeresults
| addinfo
| eval timepickerSpanSeconds=(info_max_time - info_min_time)
| eval spanToken=case(timepickerSpanSeconds>=31536000, "1m",
                      timepickerSpanSeconds>=604800,   "1d",
                      timepickerSpanSeconds<60,        "1s",
                      timepickerSpanSeconds<3600,      "1m",
                      true(),                          "1h")
| map search="search index=* earliest=$info_min_time$ latest=$info_max_time$ | timechart count span=$spanToken$ BY host"

praspai
Path Finder

Its perfectly working in searches but not in Dashboard. Its not picking value from time picker

0 Karma

woodcock
Esteemed Legend

You have to play around with the dollar-sign because it is used both by the XML and by the map command in the search. Try adding a second one to each occurrence.

0 Karma

praspai
Path Finder

Thanks ...

0 Karma

woodcock
Esteemed Legend

You can also do it like this:

... | timechart [
|makeresults 
| addinfo 
| eval timepickerSpanSeconds=(info_max_time - info_min_time) 
| eval span=case(
   timepickerSpanSeconds>=31536000, "1m", 
   timepickerSpanSeconds>=604800, "1d", 
   timepickerSpanSeconds<60, "1s", 
   timepickerSpanSeconds<3600, "1m", 
   true(), "1h") 
| table span 
| format "" "" "" "" "" ""] count BY host

This solution avoids the whole dollar-sign problem entirely.

0 Karma

dbcase
Motivator

modify this earliest=$info_min_time$ latest=$info_max_time$ to look like this earliest=$$info_min_time$$ latest=$$info_max_time$$

0 Karma

woodcock
Esteemed Legend

That's the best I have.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...