Dashboards & Visualizations

how can I set a time range based on a time token

kiamco
Path Finder

I have this query

index=summary source="summary_events_2" 
orig_source=*pnr*
ms_region=us-west-1
(ms_level=ERROR OR ms_level=error)
NOT event=no-event
| stats sum(count) as count by  event, ms_level,_time
|appendcols [|search earliest=-14d index=summary source="summary_events_2" 
              orig_source=*pnr*
             ms_region=$region$
             (ms_level=ERROR OR ms_level=error) 
             | stats sparkline(sum(count),1d) as trend_span_1d
                     sparkline(sum(count),7d) as trend_span_7d
                     by  event, ms_level]
| where count!=""

my problem is that I want to create a specific time range for sparkline. Keep in mind that I am using a drill down time token with this query. I have been searching for a way to return a range based on a time token, any ideas?
eg: starting at the $time_token$ and the past 14 days

0 Karma

somesoni2
Revered Legend

Assuming your time token is applied to the main search (before appendcols), give this a try

index=summary source="summary_events_2" 
 orig_source=*pnr*
 ms_region=us-west-1
 (ms_level=ERROR OR ms_level=error)
 NOT event=no-event
 | stats sum(count) as count by  event, ms_level,_time
 |appendcols [search [| gentimes start=-1 | addinfo | eval earliest=relative_time(info_min_time,"-14d") | eval latest=info_min_time | table earliest latest ] index=summary source="summary_events_2" 
               orig_source=*pnr*
              ms_region=$region$
              (ms_level=ERROR OR ms_level=error) 
              | stats sparkline(sum(count),1d) as trend_span_1d
                      sparkline(sum(count),7d) as trend_span_7d
                      by  event, ms_level]
 | where count!=""
0 Karma

kiamco
Path Finder

ye a this would work if applied the time token before the appendcols but unfortunately that is no the case. what I am trying to basically do is when user clicks on graph it will show the events in that specific point in time but I want the sparkline to show the trend of that event starting from 14 days before the "time_token".

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...