Answer by warren for How to make a dynamic span for a timechart?

Posted on

@RichG‘s answer is correct – but doesn’t address your core issue, which is wanting to set a specific span= for any given selected timeframe.

If you’re doing this on a "splunk dashboard", you can control a lot about how your search works by using tokens.

Create a custom time selector as a dropdown that you populate with your own choices

I do this to control just what users can select.

You might have, for example:

  • 10m
  • 1h
  • 1d
  • 1w
  • 1mo

Make those are their own static entries in a dropdown:

enter image description here

enter image description here

Then edit the source, and add some condition entries that set a second token you’ll use in your search later:

enter image description here

In your search, use the tokens thusly:

enter image description here

You can now control both the timeframe used, and the span displayed in your visualization.

Of course – name your tokens better, make as many entries as you need, etc.

from User warren – Stack Overflow https://stackoverflow.com/questions/65096655/how-to-make-a-dynamic-span-for-a-timechart/65099199#65099199
via IFTTT

merikebi