Dashboards & Visualizations

Time picker on form is not honored in "open in search" click

bwooden
Splunk Employee
Splunk Employee

I have a page that renders a search based on user selected time. If the user selects a specific time range, receives results, then clicks the magnifying glass icon (i.e. "Open in Search") the search is rendered against all time, not the time they originally picked. How do I get the automatic "Open in Search" drilldown to respect the user's selected time?

Generic repro:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime></earliestTime>
        <latestTime></latestTime>
      </event>
    </panel>
  </row>
</form>
1 Solution

bwooden
Splunk Employee
Splunk Employee

Update the earliestTime and latestTime to reflect the time chosen by the user. The form's input supports a token that can be used for that reference.

Example:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
      </event>
    </panel>
  </row>
</form>

View solution in original post

bwooden
Splunk Employee
Splunk Employee

Update the earliestTime and latestTime to reflect the time chosen by the user. The form's input supports a token that can be used for that reference.

Example:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
      </event>
    </panel>
  </row>
</form>
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...