if we do configuration in UI to add a time range picker or dropdown in dashboard, do we still need to make any chnages in xml ?
Hi @snigdhasaxena,
You have to set timerange to be the token in the panel's options.
Thank you, it helped.
But I'm adding a dropdown to select category alongwith time range picker, it doesn't work together. Any suggestions ?
@snigdhasaxena
It can work. the above example will work for time range picker only.
For dropdown, like if we have drop down for category, then in the search string, you need to pass that value like
index=abc category=$category_tok$
where category_tok is the token name of dropdown.
Hello @snigdhasaxena,
you can do it from UI only. One you have created the drop down or time range picker.
then on the panel click on edit search, and select the Time range as shared time picker. see below
<form>
<label>test1</label>
<fieldset submitButton="false">
<input type="time" token="time_tok" searchWhenChanged="true">
<label>Select Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>$time1$</title>
<single>
<search>
<done>
<set token="time1">$result.time_in_sec$</set>
</done>
<query>| makeresults | eval latest1=if($time_tok.latest|s$ == "now", now(),$time_tok.latest|s$) | eval earliest1 = if($time_tok.latest|s$ == "now", relative_time(now(), $time_tok.earliest|s$), $time_tok.earliest|s$) | eval time_in_sec= latest1 - earliest1 | eval time_in_sec = time_in_sec - (time_in_sec % 60) | fields + time_in_sec</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</form>
You can make all neccessary configuration changes in the UI, without the need to touch the plain XML code.
If you integrate a timetange picker in your Dashboard, use the edit search function for all panels in your dashboard to use the shared time picker as time constraint.
For a dropdown selection you can specify a token name in the UI as well, which you can then integrate in the searches powering your panels - such as
<your search> sourcetype=$yourTokenHere$ | rest_of_your_search
No, not required. It depends on the customization of how you want to the dropdown and time range picker to be .