Dashboards & Visualizations

How do you create a time range based off a _time-based token?

fetterman
Engager

I'm trying to pass the time parameter from an event clicked in one dashboard, into another dashboard. The receiving dashboard will display a 10 minute window (earliest=5 minutes preceding the event, latest=5 minutes after the event).

I'm using the following parameters (form.field1 is a time picker):

form.field1.earliest = $row._time$-300s
form.field1.latest = $row._time$+300s

I find that the time value is being passed over, but +-300s / 5m / etc. does not get evaluated, only appended to the time string.

0 Karma

fetterman
Engager
0 Karma
Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...