Dashboards & Visualizations

Can I have 2 independent time controllers in one dashboard?

HattrickNZ
Motivator

Can I have more than 2 time controllers in the 1 dashboard that are independent of each other?
So 1 time controller can control the timeframe on 1 chart and the 2nd time controller can control the timeframe of

This is the code for 1 but how do I make the other one?

  <input type="time" searchWhenChanged="true">
    <label>Timeframe</label>
    <default>
      <earliestTime>-1d</earliestTime>
      <latestTime>now</latestTime>
    </default>
  </input>
  ...
  <earliestTime>$earliest$</earliestTime>
  <latestTime>$latest$</latestTime>
0 Karma
1 Solution

niketn
Legend

@HattrickNZ, yes you can surely use more than one time control in your dashboard (actually form in this case). You can distinguish between these using input tokens i.e. tokTime1 and tokTime2.

   <input type="time" token="tokTime1" searchWhenChanged="true">
     <label>Timeframe 1</label>
     <default>
       <earliestTime>-1d</earliestTime>
       <latestTime>now</latestTime>
     </default>
   </input>


   <input type="time" token="tokTime2" searchWhenChanged="true">
     <label>Timeframe 2</label>
     <default>
       <earliestTime>-1d</earliestTime>
       <latestTime>now</latestTime>
     </default>
   </input>

In fact you can place these inputs under specific XML Panel using drag and drop in Dashboard UI Editor or directly in XML by placing the input inside Panel ( <panel> ) before visualization tag starts.

PS: For using the time tokens inside your search you should use tags <earliest> and <latest>. The one in your example seems to be from Advanced XML which is deprecated.

   <earliest>$tokTime1.earliest$</earliest>
   <latest>$tokTime1.latest$</latest>

And

   <earliest>$tokTime2.earliest$</earliest>
   <latest>$tokTime2.latest$</latest>

Time tokens i.e. $tokTime1.earliest$ and $tokTime1.latest$ can also be used directly in your search query's base search i.e. in the first pipe inside Splunk query string.

<search>
    <query>index="_internal" sourcetype="splunkd" log_level!="INFO" earliest=$tokTime1.earliest$ latest=$tokTime1.latest$
| timechart count
    </query>
</search>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@HattrickNZ, yes you can surely use more than one time control in your dashboard (actually form in this case). You can distinguish between these using input tokens i.e. tokTime1 and tokTime2.

   <input type="time" token="tokTime1" searchWhenChanged="true">
     <label>Timeframe 1</label>
     <default>
       <earliestTime>-1d</earliestTime>
       <latestTime>now</latestTime>
     </default>
   </input>


   <input type="time" token="tokTime2" searchWhenChanged="true">
     <label>Timeframe 2</label>
     <default>
       <earliestTime>-1d</earliestTime>
       <latestTime>now</latestTime>
     </default>
   </input>

In fact you can place these inputs under specific XML Panel using drag and drop in Dashboard UI Editor or directly in XML by placing the input inside Panel ( <panel> ) before visualization tag starts.

PS: For using the time tokens inside your search you should use tags <earliest> and <latest>. The one in your example seems to be from Advanced XML which is deprecated.

   <earliest>$tokTime1.earliest$</earliest>
   <latest>$tokTime1.latest$</latest>

And

   <earliest>$tokTime2.earliest$</earliest>
   <latest>$tokTime2.latest$</latest>

Time tokens i.e. $tokTime1.earliest$ and $tokTime1.latest$ can also be used directly in your search query's base search i.e. in the first pipe inside Splunk query string.

<search>
    <query>index="_internal" sourcetype="splunkd" log_level!="INFO" earliest=$tokTime1.earliest$ latest=$tokTime1.latest$
| timechart count
    </query>
</search>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

HattrickNZ
Motivator

tks, that looks like a great answer.

0 Karma

niketn
Legend

Thanks, please try out and confirm whether your issue is resolved.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...