All Apps and Add-ons

Get results from a Saved Search for a PullDown

Contributor

Hi,

I am attempting to get the results from a Saved Search (Scheduled) to Pull Down Menu. I am facing a problem since the pulldown is under a Timerange Picker, the results from the Saved Search fails to populate the pulldown, since there is conflict between the Schedule Time and the Time Range picker Time.

Is there any way to disregard the time range picker time information for that particular pull down search ?

Thanks

Regards

0 Karma

Contributor

Thanks for that. Looks very complicated.
I have stopped using Saved Search instead i am using a run-time search, means i have using the Timeranger picker time to drive the search for the pulldown when the dashboard is opened. Its taking a bit of time. But its manageable.

Thanks for your advice.

0 Karma

SplunkTrust
SplunkTrust

The easiest way is to just reorder the modules, so that you have

HiddenSavedSearch
  Pulldown
    TimeRangePicker

It will of course reorder the Pulldown and the TimeRangePicker visually, but this will eliminate the conflict entirely.

If you dont want to do that though for some reason, and if you're using Sideview Utils already, then there are ways to use ValueSetter modules to "stash" keys like $search.timeRange.earliest$ and $search.timeRange.latest$ away, then use Search modules to bleach the official timerange down to nothing. Here's the idea, but with a bunch of non-essential params omitted.

(The "Pulldown" in your question makes me think you're using Sideview Utils already. My apologies if you're not - this answer will seem very strange to you. 😃

<module name="TimeRangePicker">
  <module name="ValueSetter">
    <param name="name">secretEarliest</param>
    <param name="value">$search.timeRange.earliest$</param>
    <module name="ValueSetter">
      <param name="name">secretLatest</param>
      <param name="value">$search.timeRange.latest$</param>
      <module name="Search">
        <param name="earliest"> </param>
        <param name="latest"> </param>
        <module name="HiddenSavedSearch">
          <module name="Pulldown">
            <module name="Search">
              <param name="earliest">$secretEarliest$</param>
              <param name="earliest">$secretLatest$</param>

But wow is that ugly. Again my recommendation is to simply reorder the three modules so that there's no conflict.

Contributor

Thanks for that. But I am looking for a solution to a specific problem.
-:)

0 Karma

Explorer

Please read the manual as there is explanation about setting up time range.

0 Karma