form with timerangepicker to postfilter (sideview utils or intentions?)

[brettcave]

I'm building a form that I would like to filter results based on input time range.

Basically have a timerangepicker or similar component, and when the time range is selected, apply it into a search in a specific format.

e.g, to build a report that contains ALL host data, but only for hosts that reported an error within a time range specified by the picker:

<module name="TimeRangePicker"><module name="Button">
<module name="Search">
  <param name="search">
   [ search earliest="$timerange.earliest$" latest="$timerange.latest$" eventtype="SomeSortOfError" | dedup host | fields + host ] .....
  </param>
</module>
</module></module>

So from the example above, I'm looking to try get the time range from the picker into the sub-search, that is used to filter the results.

Any ideas on how to get this?

[brettcave · Accepted solution]

Stumbled across the answer: http://splunk-base.splunk.com/answers/77362/timerangepicker-as-intention

 <module name="Search">
  <param name="search">search * [search earliest="$search.timeRange.earliest$" latest="$search.timeRange.latest$" | dedup host | fields host ] | timechart count 
  <param name="earliest">-24h</param>
  <param name="latest">now</param>

[brettcave]

Correct, that's what I am trying to do. The TRP is used as a filter of objects (users registering within a certain time period in my case), while the report needs to be across all data.

[sideview]

If your intention is to apply the TRP's timerange to just the subsearch, and to run the outer search over the past 24 hours always, then you are absolutely correct. Just posting this comment to make sure.

For others reading who DONT need to do this nuanced use case, if you simply want to run both inner and outer subsearches over the given timerange, it happens automatically and you don't need to do any of this. ie you would just delete earliest="$search.timeRange.earliest$" latest="$search.timeRange.latest$" entirely and let the TimeRangePicker automatically submit its timerange.