Archive

Time picker doesn't pass time to search?

Path Finder

Hey everyone, I'm building a simple dashboard to show some info about SFTP traffic. I'm using a time picker to pick the time range of the data, but whatever I do, it doesn't seem to pass the time to the search.

My code is as follows:

<form>
  <label>SFTP Dashboard</label>
  <description>SFTP Traffic Info</description>
  <search id="main_search">
    <query>
          index=postnl source=postnl_ftp_files_hits 
          | rename session_id AS id 
          | join type=left id 
              [ search index=postnl source=postnl_ftp_sessions ] 
          | where isnotnull(ip_addr) AND size > 0 
          | eval time_duration=round(strptime(time_ended, "%F %T.%3N") - strptime(time_started, "%F %T.%3N"),1) 
          | stats values(ip_addr) AS "IP Address", values(time_started) AS "Start Time", values(time_ended) AS "End Time", values(time_duration) AS "Duration (seconds)", count(name) AS "File Count", sum(size) AS Size, values(name) AS Name BY id 
          | eval Size=round(Size/1000,2) 
          | rename id AS "Session ID", Size AS "Size (KB)" 
          | rex field=Name "^//(?<Server>[^/]+)/" 
          | eval Server=upper(Server) 
          | eval Server=mvdedup(Server) 
          | lookup PostNL_SFTP_server_applicatie_lookup.csv Server OUTPUT Application 
          | sort 0 id 
    </query>
    <earliest>$time$</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Main Table ($time$)</title>
      <table>
        <search base="main_search">
          <query>| table "Session ID", "IP Address", "Start Time", "End Time", "Duration (seconds)", "File Count", "Size (KB)", Server, Application</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="size">
          <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="number" field="size">
          <option name="precision">1</option>
          <option name="useThousandSeparators">false</option>
        </format>
        <format type="color" field="ID">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="Size (KB)">
          <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="color" field="Duration (seconds)">
          <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="color" field="Session ID">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="File Count">
          <colorPalette type="minMidMax" maxColor="#1E93C6" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
      </table>
    </panel>
  </row>
</form>

After picking a time the dashboard panel will just keep saying Search is waiting for input.... It's probably a simple thing, but I can't figure it out. Anyone have any suggestions?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi @belle501,

Try to change earliest & latest in search.
Form :

<earliest>$time$</earliest>
<latest>now</latest>

TO :

<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>

OR

<earliest>$earliest$</earliest>
<latest>$latest$</latest>

View solution in original post

SplunkTrust
SplunkTrust

Hi @belle501,

Try to change earliest & latest in search.
Form :

<earliest>$time$</earliest>
<latest>now</latest>

TO :

<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>

OR

<earliest>$earliest$</earliest>
<latest>$latest$</latest>

View solution in original post

Path Finder

Ah, thank you! Adding that to the token worked. 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!