topic Re: on Splunk 5.0 in Getting Data In

on Splunk 5.0

KShen — Fri, 10 Apr 2015 15:51:44 GMT

How to add date time range to the dashboard on the Splunk 5.0

Re: on Splunk 5.0

lguinn2 — Fri, 10 Apr 2015 18:20:43 GMT

In Splunk 5, you will probably need to use Advanced XML to do what you want. Here is a link to the 5.0 documentation:

However, I found this Example app much more useful Splunk Dashboard Examples for 5.0. It's free and it shows a lot of advanced XML code...

Re: on Splunk 5.0

KShen — Fri, 10 Apr 2015 19:03:20 GMT

"probably need to do" is not answer.

Re: on Splunk 5.0

lguinn2 — Fri, 10 Apr 2015 19:08:42 GMT

You are right, but then I thought perhaps that the advice in the duplicate question:

Do dashboards in Splunk 5.0 support dynamic date/time inputs?

didn't work for you. That question clearly pointed to the answer in the manual

Build and edit forms with simple XML

Did you read that and do what it suggested?

Re: on Splunk 5.0

KShen — Fri, 10 Apr 2015 19:39:10 GMT

I read the http://docs.splunk.com/Documentation/Splunk/5.0/Viz/Buildandeditforms

and try and datetime picker is not displayed. And I do not know how to pass the earliest and last time to the querystring. Any idea?

Monthly OR Data

error

  <!-- Create a text box; token is "series"                         -->
  <!-- label: Label for the text box                                -->
  <!-- default: A default value is not specified                    -->
  <!-- seed: Upon first load, the text box specifies 'splunkd'      -->
  <!-- suffix: All tokens are followed by a *                       -->
  <!--         If user does not specify text, then search uses '*'  -->
  <input type="text" token="series">
    <label>sourcetype</label>
    <default></default>
    <seed>splunkd</seed>
    <suffix>*</suffix>
  </input>

  <!-- Add default TimePicker -->
  <input type="time" />





<table>

  <searchString>error</searchString>
  <title></title>

</table>