Dashboards & Visualizations

Do dashboards in Splunk 5.0 support dynamic date/time inputs?

KShen
New Member

I want to know: Can this be supported on splunk 5.0?

To have a dynamic input date, you can create an dashboard and add a time input, add a panel and enter your search without puting in your search earliest= latest= . Your dashboard xml code will display as follows:

   <label>Form with time picker</label>
   <description></description>
   <fieldset submitButton="false">


     <input type="time" searchWhenChanged="true" token="global_time_input_tok">
         <label>Select time range</label>
         <default>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </default>
       </input>
   </fieldset>
   <row>
     <panel>
       <title>Global timer</title>
       <chart>
         <search>
           <query> Write your search </query>
           <earliest>$global_time_input_tok.earliest$</earliest>
           <latest>$global_time_input_tok.latest$</latest>
         </search>
       </chart>
     </panel>


   </row>
  </form>
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

First off, do update to 6.2.x, it's really neat.

While still stuck on 5.0, take a look at this: http://docs.splunk.com/Documentation/Splunk/5.0/Viz/Buildandeditforms
The example on that page includes a time range picker in 5.0-compatible syntax.

0 Karma

KShen
New Member

How to add date time range to the dashboard to the Splunk 5.0

0 Karma

NOUMSSI
Builder

Hi,
It can't work like that, you most make some changes in your source code:

<query> ... </query> is not supported in splunk 5.0

For it to work do like this:
Changes this:

<search>
            <query> Write your search </query>
            <earliest>$global_time_input_tok.earliest$</earliest>
            <latest>$global_time_input_tok.latest$</latest>
</search>

By this:

            <searchString> Write your search </searchString>
            <earliestTime>$global_time_input_tok.earliest$</earliestTime>
            <latestTime>$global_time_input_tok.latest$</latestTime>
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...