Dashboards & Visualizations

How to have dynamic time range selection for different panels?

sarahnazzar
Explorer

I've a form with different panels, there I have added a time range picker which will be the time input for some panels, but for some particular panels, based on my time input it should automatically check for last 7 days data. So based on the main time range selection it must assign time put to the particular panels.

For instance, if I give 4/30/2019 as my input in time picker then the time range for some panels should it assigned in such a way so that it checks for last 7 days data i.e (from 4/23/2019 to 4/30/2019) in those particular panels when the time token is passed.

Thanks in Advance!

0 Karma

vnravikumar
Champion

Hi

Give a try

<form>
  <label>timepicker</label>
  <fieldset submitButton="false">
    <input type="time" token="timepicker">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" |stats count by source</query>
          <earliest>$timepicker.earliest$</earliest>
          <latest>$timepicker.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" |stats count by source ,_time</query>
          <earliest>-7d@d</earliest>
          <latest>$timepicker.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
0 Karma

sarahnazzar
Explorer

Thanks for the reply!
Tried this but I'm getting the below error while selecting custom time.. This one is not working for custom time input.

Invalid latest_time: latest_time must be after earliest_time.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...