Answer by warren for Splunk – Calculate time and doubling it from the user selection

This works for the range aspect of your question (eg choosing 17-20 Jul)

It distinctly does not work for the "Presets" or "Relative" options from a time picker

When you select a date range from a time picker, you’ll get a pair of Unix epoch times returned

If you subtract $picker.earliest$ from $picker.latest$ , multiply by two, and assign the result into a new token (eg "$evenearlier$"), you’ll get the following inside your dropdown’s XML:

<change>
    <eval token="evenearlier">($picker.latest$-(($picker.latest$-$picker.earliest$)*2))</eval>
</change>

Then, down in your query, do this:

<earliest>$evenearlier$</earliest>
<latest>$picker.latest$</latest>

from User warren – Stack Overflow https://stackoverflow.com/questions/39204162/splunk-calculate-time-and-doubling-it-from-the-user-selection/73082133#73082133
via IFTTT

merikebi

warrenmyers.com