All Apps and Add-ons

loadjob or saved search to use time selector

bigdota
New Member

Hi,

Is there a way to get loadjob or saved search to be overridden with a time token to where it would be inline if submitted from dashboard instead of the dashboard using historical data? Or even have 2 separate dashboards that use the same scheduled searches.
1 view for scheduled search w/ historical(quick/effecient monitoring)
1 view for inline time-selector (for back-reference and research)

I was hoping this would work:

    <search id="basesearch10">
    <earliest>$timetoken.earliest$</earliest>
    <latest>$timetoken.latest$</latest>

It does work if i disable "used scheduled search".


sideview can already do what i want but i can't use sideview.

in sideview it would look like this:

dashboard with time selector
...

<param name="savedSearch">testsearch</param>
<param name="useHistory">false</param>

...

dashboard without time selector
...

<param name="savedSearch">testsearch</param>
<param name="useHistory">true</param>

...

How would i do this with simple XML?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 1 release of new security content via the ...

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...