Dashboards & Visualizations

Drilldown with timepicker

MrJohn230
Path Finder

I have a drilldown into another dashboard with parameters earliest=$earliest$ and latest=$latest$, this works. When I go into the drilldown dashboard directly it sets the data to come back as "all time". 

Is there a way that I can have multiple defaults or some other constrain that doesn't cause this?

Here's what I've been working on but it's not working. Any feedback would be helpful...

<input type="time" token="t_time">
  <default>
    <earliest>if(isnull($url.earliest$), "-15m@m", $url.earliest$)</earliest>
    <latest>if(isnull($url.latest$), "now", $url.latest$)</latest>
  </default>
</input>
Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

The parameters you need to pass from dashboard A to dashboard B are form.t_time.* as that's the name of your time picker in dashboard B

As I said in my initial reply, input elements in dashboard have the token names PREFIXED with form. so if you want to pass from a dashboard to another dashboard where the input field is populated from the passed URL parameters, you need to prefix the target token with form.

View solution in original post

MrJohn230
Path Finder

@bowesmana  Appreciated the response.

I'm "linking to dashboard" when I create the parameter I'm using earliest = $earliest$ and latest = $latest$ and seems to be passing to the url fine via the drill-down dashboard. What is annoying it when I go directly into the drill-down dashboard, the timepicker defaults to "All Time". My question is how can this be avoided?

When I create the timepicker in the drilldown and set a default the "link to dashboard" parameters no longer work. 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

When you click to drilldown, what are the parameters passed on the url to the second dashboard

On the second dashboard, what is the XML for the time picker? If you go to the second dashboard directly without a link and it is showing all time as the default, that is because the time picker is configured to show all time - if you want to change that without a link, edit that second dashboard and change the default.

Please post the XML for the <drilldown> section in the source dashboard and the <input> time picker in the second dashboard.

0 Karma

MrJohn230
Path Finder

@bowesmana When I click on the URL these parameters are being passed: ?earliest=1701381000&latest=1701384619

But when I add a new timepicker in the drill-down and set a default the URL becomes: ?earliest=1701381000&latest=1701384619&form.t_time.earliest=-15m&form.t_time.latest=now

Drill-down timepicker token _time default "last 15 minutes"

This is appended to the bottom of my spl (outside of the query tags)

<earliest>$t_time.earliest$</earliest>
<latest>$t_time.latest$</latest>

My timepicker XML looks like this:

<input type="time" token="t_time">
<label></label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

The parameters you need to pass from dashboard A to dashboard B are form.t_time.* as that's the name of your time picker in dashboard B

As I said in my initial reply, input elements in dashboard have the token names PREFIXED with form. so if you want to pass from a dashboard to another dashboard where the input field is populated from the passed URL parameters, you need to prefix the target token with form.

MrJohn230
Path Finder

@bowesmana Great, that works. This is what I have done. 

Parameters for dashboard A

earliest = $form.t_time.earliest$

latest = $form.t_time.latest$

Then on dashboard B my timepicker should refer to dashboard A tokens, see below.  (leaving out the token name). Now you can adjust your default accordingly, if you want the default to be your token then use $earliest$ $latest$ . But by setting your default to 15 minutes when you directly go to dashboard B you will not receive an error of missing earliest. 

<input type="time">
<label></label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I'm not sure I fully understood your question, but Input field tokens are passed as form.token_name=value in the URL, so if your token is t_time in the target dashboard, you should pass form.t_time.earliest=X&form.t_time.latest=Y in the URL

Let me know if this helps

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...