I'm familiar with creating time range pickers in advanced XML. I'm wondering if it is possible to use a time range picker in simple XML, and if so, what would the block of code look like?
I've come across this answer, but when I add the following code, the xml does not parse correctly.
<?xml version='1.0' encoding='utf-8'?>
<dashboard>
<label>MYTEST TimePicker</label>
<row>
<input type="time"/>
<input type="dropdown" token="timeSpan">
<label>Time span for charts</label>
<default>span=4h</span>
<choice value="span=5m">5 Minute</choice>
<choice value="span=10m">10 Minutes</choice>
<choice value="span=1h">1 hour</choice>
<choice value="span=4h">4 hours</choice>
<choice value="span=24h">24 hours</choice>
</input>
</row>
<row>
<table>
<searchName>blah blah blah</searchName>
...
This works. If you go into edit mode after this has been configured and drag the time picker out of the panel, it will reswizzle the dashboard to a form.
Hack:
<dashboard>
<label>Analytics</label>
<row>
<panel>
<input type="time" searchWhenChanged="true">
<label>Time Range for All Panels</label>
<default>
<earliestTime>-60m@m</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
</panel>
</row>
After moving the time picker in edit mode (out of the panel to the top of the screen.)
<form>
<label>Analytics</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" searchWhenChanged="true">
<label></label>
<default>
<earliestTime>-7d@d</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
</fieldset>
<row>
You need to enclose your inputs
inside of a fieldset
, not a row
, and yes, you also need to make the view a form
, not a dashboard
. See the examples in the docs.
I think this is possible but you probably need to use a form element to make the input form work correctly for a simple XML dashboard.
http://docs.splunk.com/Documentation/Splunk/latest/Developer/Step2CustomizeForm
Thanks, Kate. I'll need to do a little more digging into using forms in my searches if I choose to go down that route.