Can we add a time range picker that interacts dynamically with dashboard panels in Splunk 6.1 via the GUI rather than XML?

[tylerbryson]

As in the dashboard tutorial for Splunk 6, I'm happy converting panels from reports into inline searches. However, it seems: add input --> time, works differently than Splunk 6's "add time range picker" option. The latter generates this XML:

  <fieldset autoRun="true" submitButton="false">
     <input type="time" searchWhenChanged="true">
       <default>
         *whatever the user sets*
       </default>
     </input>
  </fieldset>

whereas the former yields:

  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime/>
      </default>
    </input>
  </fieldset>

Is the functionality of adding a time range picker preserved in 6.1?

In either case, creating a dynamic dashboard---which updates its panels with the changing of a time input---seemingly requires us to edit the XML directly, if only to delete the auto-generated time ranges ( <earliestTime> & <latestTime> ) for clones of reports. Is there a solution making use purely of functionality in the GUI?

[ChrisG · Accepted solution]

You can create a time range picker using the Dashboard Editor, see the Create and edit forms topic in the Dashboards and Visualizations manual.

[tylerbryson]

Thanks ChrisG, this seems to answer my question and clue me into a whole lot more awesome Splunk functionality. I'll run through my specific problem shortly.