Dashboards & Visualizations

Dashboard - How to use time range input value in other input elements

shikhanshu
Path Finder

I have a dashboard with 1 time range input and 4 multi-select inputs. The multi-select inputs are powered by populating searches for specific fields.

I want to limit those populating searches to the time range selected in the time range input. But I am not able to find a way to do that. Looks like populating searches need to have a pre-defined time-range already applied to them.

I have tried the following:

<input type="time" token="global_time" searchWhenChanged="true">
  <label>Global Time Range</label>
  <default>
    <earliestTime>-7d@h</earliestTime>
    <latestTime>now</latestTime>
  </default>
</input>

<input type="multiselect" token="design_tag">
  <label>Design Tag</label>
  <choice value="*">All</choice>
  <populatingSearch fieldForLabel="design_tag" fieldForValue="design_tag">index=myindex source=mysource | dedup design_tag | table design_tag | sort design_tag</populatingSearch>
  <valuePrefix>design_tag=="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <delimiter> OR </delimiter>
  <default>*</default>
</input>

<input type="multiselect" token="user_tag">
  <label>User Tag</label>
  <choice value="*">All</choice>
  <populatingSearch fieldForLabel="user_tag" fieldForValue="user_tag">index=myindex source=mysource | dedup user_tag | table user_tag | sort user_tag</populatingSearch>
  <valuePrefix>user_tag="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <delimiter> OR </delimiter>
  <default>*</default>
</input>

I have tried adding the following tags to each multi-select input above:

<earliestTime>$global_time.earliest$</earliestTime>
<latestTime>$global_time.latest$</latestTime>

But that has no effect.

I am able to use the $global_time$ time range in panels in this dashboard, but not other input elements.

Is this possible?

Thanks

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this (add earliest and latest attribute in populatingSearch )

 <input type="time" token="global_time" searchWhenChanged="true">
<label>Global Time Range</label>
<default>
<earliestTime>-7d@h</earliestTime>
<latestTime>now</latestTime>
</default>
</input>

<input type="multiselect" token="design_tag">
<label>Design Tag</label>
<choice value="*">All</choice>
<populatingSearch earliest="$global_time.earliest$" latest="$global_time.latest$" fieldForLabel="design_tag" fieldForValue="design_tag">index=myindex source=mysource | dedup design_tag | table design_tag | sort design_tag</populatingSearch>
<valuePrefix>design_tag=="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<default>*</default>
</input>

<input type="multiselect" token="user_tag">
<label>User Tag</label>
<choice value="*">All</choice>
<populatingSearch earliest="$global_time.earliest$" latest="$global_time.latest$" fieldForLabel="user_tag" fieldForValue="user_tag">index=myindex source=mysource | dedup user_tag | table user_tag | sort user_tag</populatingSearch>
<valuePrefix>user_tag="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<default>*</default>
</input>

View solution in original post

somesoni2
Revered Legend

Try this (add earliest and latest attribute in populatingSearch )

 <input type="time" token="global_time" searchWhenChanged="true">
<label>Global Time Range</label>
<default>
<earliestTime>-7d@h</earliestTime>
<latestTime>now</latestTime>
</default>
</input>

<input type="multiselect" token="design_tag">
<label>Design Tag</label>
<choice value="*">All</choice>
<populatingSearch earliest="$global_time.earliest$" latest="$global_time.latest$" fieldForLabel="design_tag" fieldForValue="design_tag">index=myindex source=mysource | dedup design_tag | table design_tag | sort design_tag</populatingSearch>
<valuePrefix>design_tag=="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<default>*</default>
</input>

<input type="multiselect" token="user_tag">
<label>User Tag</label>
<choice value="*">All</choice>
<populatingSearch earliest="$global_time.earliest$" latest="$global_time.latest$" fieldForLabel="user_tag" fieldForValue="user_tag">index=myindex source=mysource | dedup user_tag | table user_tag | sort user_tag</populatingSearch>
<valuePrefix>user_tag="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<default>*</default>
</input>
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...