Dashboards & Visualizations

How can I use a token to update a graph?

mahbs
Path Finder

Hi,

I'm trying to implement a time picker. I've created a token for it. I was just wondering, how would I go about using the preset options to update my graph. I thought I could pass my token to a my query in the "earliest" and "latest" field and then somehow in the background it would find data for instance in the last 30 seconds.

This is my search query, please note, I have been able to get this filter to work for dropdowns wherein, you have a list of dates, a start date and end date is selected, and the graph is updated accordingly. I need to do the same thing using the time picker.

Search Query

  source="xxx" host="xxx" index="xxx" sourcetype="xxx" earliest=-0d@d latest=now | multikv | eval ReportKey="Today"| append [search index="test" sourcetype="csv" earliest=$source_tok$ latest=$End_Date$|multikv| eval ReportKey="CPU"]|timechart span=1m avg("CPU") by ReportKey

This is all I have at the moment for the timer panel:

<input type="time" token="tp_tock" searchWhenChanged="true">
      <label>Time Picker</label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
0 Karma

DalJeanis
Legend

It's going to look something like this in your query string

 source="xxx" host="xxx" index="xxx" sourcetype="xxx"  earliest=$tp_tock.earliest$  latest=$tp_tock.latest$ | multikv...
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...