All Apps and Add-ons

Get results from a Saved Search for a PullDown

KarunK
Contributor

Hi,

I am attempting to get the results from a Saved Search (Scheduled) to Pull Down Menu. I am facing a problem since the pulldown is under a Timerange Picker, the results from the Saved Search fails to populate the pulldown, since there is conflict between the Schedule Time and the Time Range picker Time.

Is there any way to disregard the time range picker time information for that particular pull down search ?

Thanks

Regards

0 Karma

KarunK
Contributor

Thanks for that. Looks very complicated.
I have stopped using Saved Search instead i am using a run-time search, means i have using the Timeranger picker time to drive the search for the pulldown when the dashboard is opened. Its taking a bit of time. But its manageable.

Thanks for your advice.

0 Karma

sideview
SplunkTrust
SplunkTrust

The easiest way is to just reorder the modules, so that you have

HiddenSavedSearch
  Pulldown
    TimeRangePicker

It will of course reorder the Pulldown and the TimeRangePicker visually, but this will eliminate the conflict entirely.

If you dont want to do that though for some reason, and if you're using Sideview Utils already, then there are ways to use ValueSetter modules to "stash" keys like $search.timeRange.earliest$ and $search.timeRange.latest$ away, then use Search modules to bleach the official timerange down to nothing. Here's the idea, but with a bunch of non-essential params omitted.

(The "Pulldown" in your question makes me think you're using Sideview Utils already. My apologies if you're not - this answer will seem very strange to you. 😃

<module name="TimeRangePicker">
  <module name="ValueSetter">
    <param name="name">secretEarliest</param>
    <param name="value">$search.timeRange.earliest$</param>
    <module name="ValueSetter">
      <param name="name">secretLatest</param>
      <param name="value">$search.timeRange.latest$</param>
      <module name="Search">
        <param name="earliest"> </param>
        <param name="latest"> </param>
        <module name="HiddenSavedSearch">
          <module name="Pulldown">
            <module name="Search">
              <param name="earliest">$secretEarliest$</param>
              <param name="earliest">$secretLatest$</param>

But wow is that ugly. Again my recommendation is to simply reorder the three modules so that there's no conflict.

KarunK
Contributor

Thanks for that. But I am looking for a solution to a specific problem.
-:)

0 Karma

priyohw
Explorer

Please read the manual as there is explanation about setting up time range.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...