topic Do dashboards in Splunk 5.0 support dynamic date/time inputs? in Dashboards & Visualizations

Do dashboards in Splunk 5.0 support dynamic date/time inputs?

KShen — Wed, 08 Apr 2015 20:55:41 GMT

I want to know: Can this be supported on splunk 5.0?

To have a dynamic input date, you can create an dashboard and add a time input, add a panel and enter your search without puting in your search earliest= latest= . Your dashboard xml code will display as follows:

   <label>Form with time picker</label>
   <description></description>
   <fieldset submitButton="false">


     <input type="time" searchWhenChanged="true" token="global_time_input_tok">
         <label>Select time range</label>
         <default>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </default>
       </input>
   </fieldset>
   <row>
     <panel>
       <title>Global timer</title>
       <chart>
         <search>
           <query> Write your search </query>
           <earliest>$global_time_input_tok.earliest$</earliest>
           <latest>$global_time_input_tok.latest$</latest>
         </search>
       </chart>
     </panel>


   </row>
  </form>

Re: Do dashboards in Splunk 5.0 support dynamic date/time inputs?

NOUMSSI — Wed, 08 Apr 2015 22:11:52 GMT

Hi,
It can't work like that, you most make some changes in your source code:

<query> ... </query> is not supported in splunk 5.0

For it to work do like this:
Changes this:

<search>
            <query> Write your search </query>
            <earliest>$global_time_input_tok.earliest$</earliest>
            <latest>$global_time_input_tok.latest$</latest>
</search>

By this:

            <searchString> Write your search </searchString>
            <earliestTime>$global_time_input_tok.earliest$</earliestTime>
            <latestTime>$global_time_input_tok.latest$</latestTime>

Re: Do dashboards in Splunk 5.0 support dynamic date/time inputs?

martin_mueller — Wed, 08 Apr 2015 22:53:50 GMT

First off, do update to 6.2.x, it's really neat.

While still stuck on 5.0, take a look at this: http://docs.splunk.com/Documentation/Splunk/5.0/Viz/Buildandeditforms
The example on that page includes a time range picker in 5.0-compatible syntax.

Re: Do dashboards in Splunk 5.0 support dynamic date/time inputs?

KShen — Fri, 10 Apr 2015 15:45:16 GMT

How to add date time range to the dashboard to the Splunk 5.0