Dashboards & Visualizations

Form search is not working from Input

msackett
New Member

I built a Form and have Inputs, but none of the inputs work. I tried one at a time and all together. It seems like the basic search is correct, but still not working. Can anyone help find out why? Below is the form and I only have one search currently in it. Looking to add multiple inputs if I can get this one to work.

<form>
  <label>ITO Session Log</label>
  <description>Search</description>
  <fieldset submitButton="true">
    <input type="time" token="Time" searchWhenChanged="false">
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="id" searchWhenChanged="true">
      <label>Cafe</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <title>Session Log</title>
        <search>
          <query>index=ff Cafe=$id$</query>
          <earliest>$Time.earliest$</earliest>
          <latest>$Time.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>[]</fields>
      </event>
    </panel>
  </row>
</form>
Tags (2)
0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust

Try taking out the

           <earliest>$Time.earliest$</earliest>
           <latest>$Time.latest$</latest>

entries from your row. Also remove the token="Time" config from the time picker. The dashboard will default to the time given by the picker. Let me know how that works.

View solution in original post

0 Karma

muebel
SplunkTrust
SplunkTrust

Try taking out the

           <earliest>$Time.earliest$</earliest>
           <latest>$Time.latest$</latest>

entries from your row. Also remove the token="Time" config from the time picker. The dashboard will default to the time given by the picker. Let me know how that works.

0 Karma

msackett
New Member

That worked... Thanks for the help..

0 Karma

woodcock
Esteemed Legend

Be sure to click "Accept".

Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...