Dashboards & Visualizations

Create a time picker in simple XML?

dang
Path Finder

I'm familiar with creating time range pickers in advanced XML. I'm wondering if it is possible to use a time range picker in simple XML, and if so, what would the block of code look like?

I've come across this answer, but when I add the following code, the xml does not parse correctly.

    <?xml version='1.0' encoding='utf-8'?>
      <dashboard>
        <label>MYTEST TimePicker</label>
          <row>
          <input type="time"/>    
          <input type="dropdown" token="timeSpan">
              <label>Time span for charts</label>
              <default>span=4h</span>
              <choice value="span=5m">5 Minute</choice>
              <choice value="span=10m">10 Minutes</choice>
              <choice value="span=1h">1 hour</choice>
              <choice value="span=4h">4 hours</choice>
              <choice value="span=24h">24 hours</choice>    
           </input>
          </row>
          <row>
            <table>
              <searchName>blah blah blah</searchName>
              ...
Tags (1)
0 Karma

Kyle_Jackson
Explorer

This works. If you go into edit mode after this has been configured and drag the time picker out of the panel, it will reswizzle the dashboard to a form.

Hack:
    <dashboard>
        <label>Analytics</label>
      <row>
       <panel>
        <input type="time" searchWhenChanged="true">
          <label>Time Range for All Panels</label>
          <default>
             <earliestTime>-60m@m</earliestTime>
             <latestTime>now</latestTime>
          </default>
        </input>
       </panel>
      </row>

After moving the time picker in edit mode (out of the panel to the top of the screen.)

    <form>
      <label>Analytics</label>
      <fieldset submitButton="false" autoRun="true">
        <input type="time" searchWhenChanged="true">
          <label></label>
          <default>
            <earliestTime>-7d@d</earliestTime>
            <latestTime>now</latestTime>
          </default>
        </input>
      </fieldset>
      <row>

gkanapathy
Splunk Employee
Splunk Employee

You need to enclose your inputs inside of a fieldset, not a row, and yes, you also need to make the view a form, not a dashboard. See the examples in the docs.

Kate_Lawrence-G
Contributor

I think this is possible but you probably need to use a form element to make the input form work correctly for a simple XML dashboard.

http://docs.splunk.com/Documentation/Splunk/latest/Developer/Step2CustomizeForm

0 Karma

dang
Path Finder

Thanks, Kate. I'll need to do a little more digging into using forms in my searches if I choose to go down that route.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...