topic searchPostProcess downstream panels not reloading after token input change in Dashboards & Visualizations

searchPostProcess downstream panels not reloading after token input change

the_wolverine — Thu, 28 Jan 2016 18:54:13 GMT

I have a form that uses a searchTemplate and postProcess. The form is so that the user can select the time range for the base query. When I change the time range using the drop down, my postProcess panels are not being updated. What am I don't wrong?

<form>
  <label>Sample Dashboard</label>
  <description>USES POSTPROCESS</description>
    <fieldset submitButton="true" autoRun="false">
    <input type="time" token="earliest" searchWhenChanged="true">
      <label>Select Timerange</label>
      <default>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <searchTemplate>index=summary search_name="Summary Test" | stats sum(total) as total sum(bytes) as bytes by city,state</searchTemplate> 
          <earliest>$earliest.earliest$</earliest>
          <latest>$earliest.latest$</latest>
  <row>
    <panel>
      <table>
        <title>bytes by city,state</title>
        <searchPostProcess>search state=CA  | stats sum(bytes) as bytes by city </searchPostProcess>
          <earliest>$earliest.earliest$</earliest>
          <latest>$earliest.latest$</latest>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
</row>
</form>

Re: searchPostProcess downstream panels not reloading after token input change

renjith_nair — Fri, 29 Jan 2016 06:22:48 GMT

Which versin of splunk you are using ?

I think you should use

               <earliestTime>$earliest.earliest$</earliestTime>
               <latestTime>$earliest.latest$</latestTime>

Instead of earliest and latest

Below works fine for me

     <form>
       <label>Sample Dashboard</label>
       <description>USES POSTPROCESS</description>
         <fieldset submitButton="false" autoRun="false">
         <input type="time" token="earliest" searchWhenChanged="true">
           <label>Select Timerange</label>
           <default>Last 24 hours</default>
         </input>
       </fieldset>
       <searchTemplate>index=_internal | stats count by sourcetype</searchTemplate> 
               <earliestTime>$earliest.earliest$</earliestTime>
               <latestTime>$earliest.latest$</latestTime>
       <row>
         <panel>
           <table>
             <title>bytes by city,state</title>
             <searchPostProcess>search sourcetype="splunkd"  | stats sum(count) </searchPostProcess>
               <earliestTime>$earliest.earliest$</earliestTime>
               <latestTime>$earliest.latest$</latestTime>
             <option name="wrap">true</option>
             <option name="rowNumbers">false</option>
             <option name="dataOverlayMode">none</option>
             <option name="drilldown">cell</option>
             <option name="count">10</option>
           </table>
         </panel>
     </row>
     </form>

Re: searchPostProcess downstream panels not reloading after token input change

renjith_nair — Mon, 01 Feb 2016 04:44:26 GMT

Does it work for you?