All Apps and Add-ons

form with timerangepicker to postfilter (sideview utils or intentions?)

brettcave
Builder

I'm building a form that I would like to filter results based on input time range.

Basically have a timerangepicker or similar component, and when the time range is selected, apply it into a search in a specific format.

e.g, to build a report that contains ALL host data, but only for hosts that reported an error within a time range specified by the picker:

<module name="TimeRangePicker"><module name="Button">
<module name="Search">
  <param name="search">
   [ search earliest="$timerange.earliest$" latest="$timerange.latest$" eventtype="SomeSortOfError" | dedup host | fields + host ] .....
  </param>
</module>
</module></module>

So from the example above, I'm looking to try get the time range from the picker into the sub-search, that is used to filter the results.

Any ideas on how to get this?

0 Karma
1 Solution

brettcave
Builder

Stumbled across the answer: http://splunk-base.splunk.com/answers/77362/timerangepicker-as-intention

 <module name="Search">
  <param name="search">search * [search earliest="$search.timeRange.earliest$" latest="$search.timeRange.latest$" | dedup host | fields host ] | timechart count 
  <param name="earliest">-24h</param>
  <param name="latest">now</param>

View solution in original post

0 Karma

brettcave
Builder

Stumbled across the answer: http://splunk-base.splunk.com/answers/77362/timerangepicker-as-intention

 <module name="Search">
  <param name="search">search * [search earliest="$search.timeRange.earliest$" latest="$search.timeRange.latest$" | dedup host | fields host ] | timechart count 
  <param name="earliest">-24h</param>
  <param name="latest">now</param>
0 Karma

brettcave
Builder

Correct, that's what I am trying to do. The TRP is used as a filter of objects (users registering within a certain time period in my case), while the report needs to be across all data.

0 Karma

sideview
SplunkTrust
SplunkTrust

If your intention is to apply the TRP's timerange to just the subsearch, and to run the outer search over the past 24 hours always, then you are absolutely correct. Just posting this comment to make sure.

For others reading who DONT need to do this nuanced use case, if you simply want to run both inner and outer subsearches over the given timerange, it happens automatically and you don't need to do any of this. ie you would just delete earliest="$search.timeRange.earliest$" latest="$search.timeRange.latest$" entirely and let the TimeRangePicker automatically submit its timerange.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...