topic Re: Set given preset value in time range picker in Splunk Search

Set given preset value in time range picker

fjp2485 — Mon, 13 May 2019 12:08:13 GMT

Hi,

I'm using Splunk Enterprise 7.2.3.
I have a time range picker on my dashboard to set the date/time range to search between. I want to set its default value to "Previous week". In the XML code of the dashboard I can calculate the required date range and I can set that in the time range picker also (and it works well), but the displayed preset value will be: "Between Date-times". But I want to show: "Previous week". How can I do it?

Thanks in advance,
fjp2485

Re: Set given preset value in time range picker

somesoni2 — Mon, 13 May 2019 14:13:14 GMT

In your dashboard xml, update the stanza for time input to use following relative time range:
Updated

<earliest>-7d@w0</earliest>
<latest>@w0</latest>

Re: Set given preset value in time range picker

fjp2485 — Tue, 14 May 2019 07:44:39 GMT

Hi somesoni2,

Thanks for your answer.
You probably meant -1w@w0 instead of -7w, isn't it?

So the complete input section supposed to look like this:

    <input type="time" token="range" searchWhenChanged="true">
      <label>Set Date/Time Range</label>
      <default>
        <earliest>-1w@w0</earliest>
        <latest>@w0</latest>
      </default>
    </input>

Unfortunately the displayed text is "Custom time", see screenshot below:

But my specification prescribes to show: "Previous week" because this text is more informative for the user.

Re: Set given preset value in time range picker

fjp2485 — Tue, 14 May 2019 09:21:17 GMT

I've found a solution: the default value of the dat/time picker has to be Previous week. See the code below. In addition in its change section it contains code which converts the earliest and latest values to human readable form (earliest_str and latest_str).

    <input type="time" token="range" searchWhenChanged="true">
      <label>Set Date/Time Range</label>
      <default>Previous week</default>
      <change>
        <eval token="earliest_tok">if(isnum($range.earliest$), $range.earliest$, relative_time(now(), $range.earliest$))</eval>
        <eval token="latest_tok">if(isnull($range.latest$), now(), if(isnum($range.latest$), $range.latest$, relative_time(now(), $range.latest$)))</eval>
        <eval token="earliest_str">strftime($earliest_tok$, "%Y.%m.%d")</eval>
        <eval token="latest_str">strftime($latest_tok$ - 1, "%Y.%m.%d")</eval>
      </change>
    </input>

In order to have right earliest_str and latest_str just after opening the dashboard we have to initialize them in the init section of the dashboard:

  <init>
    <eval token="earliest_tok">relative_time(now(), "-7d@w0")</eval>
    <eval token="latest_tok">relative_time(now(), "@w0")</eval>
    <eval token="earliest_str">strftime($earliest_tok$, "%Y.%m.%d")</eval>
    <eval token="latest_str">strftime($latest_tok$ - 1, "%Y.%m.%d")</eval>
  </init>

In this init section the relative date format is to be used: "-7d@w0" and "@w0" which is equivalent to Previous week default value of the date/time picker input control.

Re: Set given preset value in time range picker

somesoni2 — Tue, 14 May 2019 14:55:09 GMT

That was a typo on my side. I wanted to use -7d@w0. Also, I'm assuming you're launching the dashboard fresh (from navigation menu) after making change so that it's using the default values of the time range picker.