<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Drilldown with timepicker in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670466#M54872</link>
    <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367"&gt;@bowesmana&lt;/a&gt;&amp;nbsp;Great, that works. This is what I have done.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;Parameters for dashboard A&lt;/P&gt;&lt;P&gt;earliest = $form.t_time.earliest$&lt;/P&gt;&lt;P&gt;latest = $form.t_time.latest$&lt;/P&gt;&lt;P&gt;Then on dashboard B my timepicker should refer to dashboard A tokens, see below.&amp;nbsp; (leaving out the token name). Now you can adjust your default accordingly, if you want the default to be your token then use $earliest$ $latest$ . But by setting your default to 15 minutes when you directly go to dashboard B you will not receive an error of missing earliest.&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;input type="time"&amp;gt;
&amp;lt;label&amp;gt;&amp;lt;/label&amp;gt;
&amp;lt;default&amp;gt;
&amp;lt;earliest&amp;gt;-15m&amp;lt;/earliest&amp;gt;
&amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
&amp;lt;/default&amp;gt;
&amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Fri, 01 Dec 2023 14:12:54 GMT</pubDate>
    <dc:creator>MrJohn230</dc:creator>
    <dc:date>2023-12-01T14:12:54Z</dc:date>
    <item>
      <title>Drilldown with timepicker</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670244#M54847</link>
      <description>&lt;P&gt;I have a drilldown into another dashboard with parameters earliest=$earliest$ and latest=$latest$, this works. When I go into the drilldown dashboard directly it sets the data to come back as "all time".&amp;nbsp;&lt;/P&gt;&lt;P&gt;Is there a way that I can have multiple defaults or some other constrain that doesn't cause this?&lt;BR /&gt;&lt;BR /&gt;Here's what I've been working on but it's not working. Any feedback would be helpful...&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;input type="time" token="t_time"&amp;gt;
  &amp;lt;default&amp;gt;
    &amp;lt;earliest&amp;gt;if(isnull($url.earliest$), "-15m@m", $url.earliest$)&amp;lt;/earliest&amp;gt;
    &amp;lt;latest&amp;gt;if(isnull($url.latest$), "now", $url.latest$)&amp;lt;/latest&amp;gt;
  &amp;lt;/default&amp;gt;
&amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Thu, 30 Nov 2023 00:09:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670244#M54847</guid>
      <dc:creator>MrJohn230</dc:creator>
      <dc:date>2023-11-30T00:09:39Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown with timepicker</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670400#M54863</link>
      <description>&lt;P&gt;I'm not sure I fully understood your question, but&amp;nbsp;Input field tokens are passed as &lt;STRONG&gt;form.token_name=value&lt;/STRONG&gt; in the URL, so if your token is t_time in the target dashboard, you should pass &lt;STRONG&gt;form.t_time.earliest=X&amp;amp;form.t_time.latest=Y&lt;/STRONG&gt; in the URL&lt;/P&gt;&lt;P&gt;Let me know if this helps&lt;/P&gt;</description>
      <pubDate>Thu, 30 Nov 2023 21:54:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670400#M54863</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2023-11-30T21:54:50Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown with timepicker</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670402#M54864</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367"&gt;@bowesmana&lt;/a&gt;&amp;nbsp; Appreciated the response.&lt;/P&gt;&lt;P&gt;I'm "linking to dashboard" when I create the parameter I'm using earliest = $earliest$ and latest = $latest$ and seems to be passing to the url fine via the drill-down dashboard. What is annoying it when I go directly into the drill-down dashboard, the timepicker defaults to "All Time". My question is how can this be avoided?&lt;BR /&gt;&lt;BR /&gt;When I create the timepicker in the drilldown and set a default the "link to dashboard" parameters no longer work.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 30 Nov 2023 22:10:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670402#M54864</guid>
      <dc:creator>MrJohn230</dc:creator>
      <dc:date>2023-11-30T22:10:16Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown with timepicker</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670405#M54865</link>
      <description>&lt;P&gt;When you click to drilldown, what are the parameters passed on the url to the second dashboard&lt;/P&gt;&lt;P&gt;On the second dashboard, what is the XML for the time picker? If you go to the second dashboard directly without a link and it is showing all time as the default, that is because the time picker is configured to show all time - if you want to change that without a link, edit that second dashboard and change the default.&lt;/P&gt;&lt;P&gt;Please post the XML for the &amp;lt;drilldown&amp;gt; section in the source dashboard and the &amp;lt;input&amp;gt; time picker in the second dashboard.&lt;/P&gt;</description>
      <pubDate>Thu, 30 Nov 2023 23:08:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670405#M54865</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2023-11-30T23:08:13Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown with timepicker</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670406#M54866</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367"&gt;@bowesmana&lt;/a&gt;&amp;nbsp;When I click on the URL these parameters are being passed:&amp;nbsp;?earliest=1701381000&amp;amp;latest=1701384619&lt;BR /&gt;&lt;BR /&gt;But when I add a new timepicker in the drill-down and set a default the URL becomes:&amp;nbsp;?earliest=1701381000&amp;amp;latest=1701384619&amp;amp;form.t_time.earliest=-15m&amp;amp;form.t_time.latest=now&lt;/P&gt;&lt;P&gt;Drill-down timepicker token _time default "last 15 minutes"&lt;/P&gt;&lt;P&gt;This is appended to the bottom of my spl (outside of the query tags)&lt;/P&gt;&lt;P&gt;&amp;lt;earliest&amp;gt;$t_time.earliest$&amp;lt;/earliest&amp;gt;&lt;BR /&gt;&amp;lt;latest&amp;gt;$t_time.latest$&amp;lt;/latest&amp;gt;&lt;/P&gt;&lt;P&gt;My timepicker XML looks like this:&lt;/P&gt;&lt;P&gt;&amp;lt;input type="time" token="t_time"&amp;gt;&lt;BR /&gt;&amp;lt;label&amp;gt;&amp;lt;/label&amp;gt;&lt;BR /&gt;&amp;lt;default&amp;gt;&lt;BR /&gt;&amp;lt;earliest&amp;gt;-15m&amp;lt;/earliest&amp;gt;&lt;BR /&gt;&amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;&lt;BR /&gt;&amp;lt;/default&amp;gt;&lt;BR /&gt;&amp;lt;/input&amp;gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 30 Nov 2023 23:44:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670406#M54866</guid>
      <dc:creator>MrJohn230</dc:creator>
      <dc:date>2023-11-30T23:44:27Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown with timepicker</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670411#M54867</link>
      <description>&lt;P&gt;The parameters you need to pass from dashboard A to dashboard B are form.t_time.* as that's the name of your time picker in dashboard B&lt;/P&gt;&lt;P&gt;As I said in my initial reply, input elements in dashboard have the token names PREFIXED with &lt;STRONG&gt;form.&lt;/STRONG&gt;&amp;nbsp;so if you want to pass from a dashboard to another dashboard where the input field is populated from the passed URL parameters, you need to prefix the target token with form.&lt;/P&gt;</description>
      <pubDate>Fri, 01 Dec 2023 03:48:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670411#M54867</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2023-12-01T03:48:08Z</dc:date>
    </item>
    <item>
      <title>Re: Drilldown with timepicker</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670466#M54872</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367"&gt;@bowesmana&lt;/a&gt;&amp;nbsp;Great, that works. This is what I have done.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;Parameters for dashboard A&lt;/P&gt;&lt;P&gt;earliest = $form.t_time.earliest$&lt;/P&gt;&lt;P&gt;latest = $form.t_time.latest$&lt;/P&gt;&lt;P&gt;Then on dashboard B my timepicker should refer to dashboard A tokens, see below.&amp;nbsp; (leaving out the token name). Now you can adjust your default accordingly, if you want the default to be your token then use $earliest$ $latest$ . But by setting your default to 15 minutes when you directly go to dashboard B you will not receive an error of missing earliest.&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;input type="time"&amp;gt;
&amp;lt;label&amp;gt;&amp;lt;/label&amp;gt;
&amp;lt;default&amp;gt;
&amp;lt;earliest&amp;gt;-15m&amp;lt;/earliest&amp;gt;
&amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
&amp;lt;/default&amp;gt;
&amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 01 Dec 2023 14:12:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drilldown-with-timepicker/m-p/670466#M54872</guid>
      <dc:creator>MrJohn230</dc:creator>
      <dc:date>2023-12-01T14:12:54Z</dc:date>
    </item>
  </channel>
</rss>

