All Apps and Add-ons

Get results from a Saved Search for a PullDown

KarunK
Contributor

Hi,

I am attempting to get the results from a Saved Search (Scheduled) to Pull Down Menu. I am facing a problem since the pulldown is under a Timerange Picker, the results from the Saved Search fails to populate the pulldown, since there is conflict between the Schedule Time and the Time Range picker Time.

Is there any way to disregard the time range picker time information for that particular pull down search ?

Thanks

Regards

0 Karma

KarunK
Contributor

Thanks for that. Looks very complicated.
I have stopped using Saved Search instead i am using a run-time search, means i have using the Timeranger picker time to drive the search for the pulldown when the dashboard is opened. Its taking a bit of time. But its manageable.

Thanks for your advice.

0 Karma

sideview
SplunkTrust
SplunkTrust

The easiest way is to just reorder the modules, so that you have

HiddenSavedSearch
  Pulldown
    TimeRangePicker

It will of course reorder the Pulldown and the TimeRangePicker visually, but this will eliminate the conflict entirely.

If you dont want to do that though for some reason, and if you're using Sideview Utils already, then there are ways to use ValueSetter modules to "stash" keys like $search.timeRange.earliest$ and $search.timeRange.latest$ away, then use Search modules to bleach the official timerange down to nothing. Here's the idea, but with a bunch of non-essential params omitted.

(The "Pulldown" in your question makes me think you're using Sideview Utils already. My apologies if you're not - this answer will seem very strange to you. 😃

<module name="TimeRangePicker">
  <module name="ValueSetter">
    <param name="name">secretEarliest</param>
    <param name="value">$search.timeRange.earliest$</param>
    <module name="ValueSetter">
      <param name="name">secretLatest</param>
      <param name="value">$search.timeRange.latest$</param>
      <module name="Search">
        <param name="earliest"> </param>
        <param name="latest"> </param>
        <module name="HiddenSavedSearch">
          <module name="Pulldown">
            <module name="Search">
              <param name="earliest">$secretEarliest$</param>
              <param name="earliest">$secretLatest$</param>

But wow is that ugly. Again my recommendation is to simply reorder the three modules so that there's no conflict.

KarunK
Contributor

Thanks for that. But I am looking for a solution to a specific problem.
-:)

0 Karma

priyohw
Explorer

Please read the manual as there is explanation about setting up time range.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...