I have need of creating a dashboard that will compare 2 sets of data from different times. Thus, I need to bypass the time picker. I realize that I may do this by including an earliest=x latest=y statement in my search. What I am trying to do, is combine an absolute date with a relative statement. The reason is that the absolute date in each of the two charts needs to be a variable from a button on the dashboard, in the example I am trying to build, this is a deployment date. I want to search x number (another variable) of days before and after that deployment date.
ex,
index=my_index source=my_source earliest=07/19/2023:00:00:00 latest=07/19/2023:23:59:59
In this example the deployment date is the 19th of July. How I would I write this to be 07/19/2023:23:59:59 +/- x days so that I can make both the Absolute date itself, and the number of days a variable tied to dropdown buttons in the dashboard.
... View more