All Apps and Add-ons

form with timerangepicker to postfilter (sideview utils or intentions?)

brettcave
Builder

I'm building a form that I would like to filter results based on input time range.

Basically have a timerangepicker or similar component, and when the time range is selected, apply it into a search in a specific format.

e.g, to build a report that contains ALL host data, but only for hosts that reported an error within a time range specified by the picker:

<module name="TimeRangePicker"><module name="Button">
<module name="Search">
  <param name="search">
   [ search earliest="$timerange.earliest$" latest="$timerange.latest$" eventtype="SomeSortOfError" | dedup host | fields + host ] .....
  </param>
</module>
</module></module>

So from the example above, I'm looking to try get the time range from the picker into the sub-search, that is used to filter the results.

Any ideas on how to get this?

0 Karma
1 Solution

brettcave
Builder

Stumbled across the answer: http://splunk-base.splunk.com/answers/77362/timerangepicker-as-intention

 <module name="Search">
  <param name="search">search * [search earliest="$search.timeRange.earliest$" latest="$search.timeRange.latest$" | dedup host | fields host ] | timechart count 
  <param name="earliest">-24h</param>
  <param name="latest">now</param>

View solution in original post

0 Karma

brettcave
Builder

Stumbled across the answer: http://splunk-base.splunk.com/answers/77362/timerangepicker-as-intention

 <module name="Search">
  <param name="search">search * [search earliest="$search.timeRange.earliest$" latest="$search.timeRange.latest$" | dedup host | fields host ] | timechart count 
  <param name="earliest">-24h</param>
  <param name="latest">now</param>
0 Karma

brettcave
Builder

Correct, that's what I am trying to do. The TRP is used as a filter of objects (users registering within a certain time period in my case), while the report needs to be across all data.

0 Karma

sideview
SplunkTrust
SplunkTrust

If your intention is to apply the TRP's timerange to just the subsearch, and to run the outer search over the past 24 hours always, then you are absolutely correct. Just posting this comment to make sure.

For others reading who DONT need to do this nuanced use case, if you simply want to run both inner and outer subsearches over the given timerange, it happens automatically and you don't need to do any of this. ie you would just delete earliest="$search.timeRange.earliest$" latest="$search.timeRange.latest$" entirely and let the TimeRangePicker automatically submit its timerange.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...