I have a dashboard which comes with a universal time field. I want to use it for my timecharts as well. But it acts differently when my time filter is set within a specific month. It works if I select the time field as "advanced" and set the earliest to -1mon@mon and latest to @mon. I want my timecharts to compare the month in time field and the previous month. For example, if I select the time to be in the month of September then my timechart will take that month to be the latest time frame and earliest to be August. Is this possible in Splunk? Thanks.
Hi @tamduong16,
One way of getting a relative time is to use eval's relative_time
function. Lets say your universal time field is called universalTimeField
, and you can access it from index=bar
index=foo
[ search index=bar
| head 1
| eval earliest = relative_time(universalTimeField, "-1mon@mon")
| return earliest ]
| search continues...
The layout would be similar if you were using a token. The basic concept is to return earliest & or latest in the subsearch, which will be passed as constraints to the outer (or main) search.
If I understand you correctly, what you need to do is create an eval-based
token assignment in the <change>
section of your timepicker set to $time.earliest$-1mon@mon
. Then use the new token for your earliest value and $time.earliest$
for your latest value.
Hi @tamduong16,
One way of getting a relative time is to use eval's relative_time
function. Lets say your universal time field is called universalTimeField
, and you can access it from index=bar
index=foo
[ search index=bar
| head 1
| eval earliest = relative_time(universalTimeField, "-1mon@mon")
| return earliest ]
| search continues...
The layout would be similar if you were using a token. The basic concept is to return earliest & or latest in the subsearch, which will be passed as constraints to the outer (or main) search.