Refine your search:

Is there a way to add time range in a form search, eg. specify start time and end time? right now i have a drop down list with a few options. But we would like to let user specify a time range as what they wish to see.

Thanks.

asked 07 Nov '11, 21:14

xiaoyuew's gravatar image

xiaoyuew
276
accept rate: 33%


2 Answers:

Yes. If your dashboard is in advanced XML (you can convert it by adding ?showsource=1 to the end of your dashboard link, e.g /en-US/app/search/dashboard_live?showsource=1 This will display a page with a box that contains the converted simple xml in advanced xml)

You can then use the code;

  <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
        <module name="TimeRangePicker">    
        <param name="label">Select Time Range: </param>
          <param name="searchWhenChanged">True</param>
          <param name="selected">Last 4 hours</param>

If you enclose all searches you want to inherit the time from this module by closing the module after them then as the user changes the selected time range it will update all searches.

To define the time ranges (other than default) you can edit times.conf (or create your own in the appname/local directory. See the following link for more detail;

http://docs.splunk.com/Documentation/Splunk/latest/admin/Timesconf

link

answered 08 Nov '11, 04:08

Drainy's gravatar image

Drainy
8.4k618
accept rate: 25%

In addition to Draineh's answer, this can also be done in simple XML. Just use <input type="time"/>. Complete example below:

<form>
  <label>Example search form</label>

  <searchTemplate>sourcetype="example" someparam="$someparam$"</searchTemplate>

  <fieldset>
    <input type="text" token="someparam">
      <label>Value to filter someparam on</label>
      <seed>*</seed>
    </input>

    <input type="time"/>
  </fieldset>

  <row>
    <table>
      <title>Search results</title>
      <fields>_time, someparam, _raw</fields>
      <option name="showPager">true</option>
      <option name="count">30</option>
      <option name="displayRowNumbers">false</option>
      </table>
  </row>
</form>
link

answered 08 Nov '11, 07:40

Ayn's gravatar image

Ayn
26.0k3717
accept rate: 41%

Thanks, Ayn.

What if I only want to have 3 options in the dropdown list, instead of the 10 choices we have by default? say i only want last 4 hours, last 24 hours and last 7 days.

(08 Nov '11, 13:54) xiaoyuew

I understand that there is an option for that which is to change the configuration in the times.conf.However, we don't want to do that. We just want this form to have fewer drop down options.

(08 Nov '11, 14:01) xiaoyuew
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×112

Asked: 07 Nov '11, 21:14

Seen: 1,087 times

Last updated: 08 Nov '11, 14:02

Copyright © 2005-2012 Splunk Inc. All rights reserved.