I have a radio button group input in my dashboard like this:
var input10 = new RadioGroupInput({
"id": "input10",
"choices":
[
{"label": "GMT-0100", "value": "one"},
{"label": "GMT-0200", "value": "two"}
],
"selectFirstChoice": false,
"searchWhenChanged": true,
"value": "$tok_interval$",
"el": $('#input10')
}, {tokens: true}).render();
input10.on("change", function(newValue) {
FormUtils.handleValueChange(input10);
});
input10.on("valueChange", function(e)
{
if (EventHandler.evaluateCondition("match(value, \"one\")", e.data)) {
EventHandler.setToken("tzadjust", "| eval _time=_time -3600", {}, e.data);
}
if (EventHandler.evaluateCondition("match(value, \"one\")", e.data))
{
EventHandler.setToken("tzadjust", "| eval _time=_time -7200", {}, e.data);
}
});
And I perform a search for a panel in my dashboard like this:
var search23 = new SearchManager({
"id": "search23",
"cancelOnUnload": true,
"search": "index=$Vindx$| eval attempts=metrics| **timechart span=$tok_interval$** sum(attempts) as Attempts , $query$ **$tzadjust$** | fields _time,Attempts,sum(metrics) ", // **$tzadjust$** value is set to **|eval _time=_time -3600** during search.
**"latest_time": "$tok_time.latest$",** // Tried changing this to "latest_time": "$tok_time.latest$-3600",
"status_buckets": 0,
**"earliest_time": "$tok_time.earliest$",** // Tried changing this to "earliest_time": "$tok_time.earliest$-3600",
"sample_ratio": null,
"app": utils.getCurrentApp(),
"auto_cancel": 90,
"preview": true,
"runWhenTimeIsUndefined": false,
"cache": true
}, {tokens: true, tokenNamespace: "submitted"});
Let me present you the scenario I'm facing: Now for eg, I have data between 10pm to 11pm in the GMT Timezone. And, My timezone is set to GMT in splunk settings. If I search for a range between 10 pm to 11 pm using the timerangepicker input, data between 10 pm to 11 pm range is shown. Now, I have another radio button input in my dashboard GMT-0100. Upon choosing GMT-0100 timezone from this input in my dashboard, I'm adding | eval _time = _time - 3600 to the search which would mean now the _time field(i.e data) is shifted between 9 pm and 10 pm. Now, I have selected the radio button input GMT-0100 and if I select the time range 9 pm to 10 pm in the timerangepicker, I'm getting "no results found". Wheareas if I select 10 pm to 11 pm in the timerangepicker again, I'm getting the data, but now it displays data between 9pm to 10pm, whereas if I had not not applied -3600 offset, it would have showed the data to be between 10 pm and 11 pm. This discrepancy maybe confusing to the user since he chose a different time range. Which tokens should I modify if I've chosen GMT-0100 from my radiobutton input and select 9 pm to 10pm timerange to display data correctly between this range and for this timezone?
... View more