Form tokens not being set properly.

[bkcarter]

Please tell me why the first test form works, and the second one does not. By works, I mean that they default time picker is set to the value assigned to the num_of_days token.

<form  script="showtokens.js">
    <label>Test</label>

    <init>
        <set token="num_of_days">Last 30 days</set>
    </init>


    <fieldset autoRun="true" submitButton="false">  

        <input type="time" searchWhenChanged="true">
            <label>Select a time:</label>
            <default>$num_of_days$</default>
        </input>

    </fieldset>    

    <row>
       <chart>
            <title>Events</title>
            <search>
                <query>index=_internal</query>
            </search>
        </chart>
    </row> 

    <row>
        <table>
            <title>Table</title>
            <search>
                <query>index=_internal</query>
            </search>  
        </table>
    </row>

</form>

The showtokens.js results are:

Token            Default    Submitted   URL
$earliest$  -30d@d  -30d@d       -30d@d
$latest$            now now              now
$num_of_days$   Last 30 days      Last 30 days  undefined

The second test form changes only the num_of_days token to 90 days as follows:

<form  script="showtokens.js">
    <label>Test</label>

    <init>
        <set token="num_of_days">Last 90 days</set>
    </init>


    <fieldset autoRun="true" submitButton="false">  

        <input type="time" searchWhenChanged="true">
            <label>Select a time:</label>
            <default>$num_of_days$</default>
        </input>

    </fieldset>    

    <row>
       <chart>
            <title>Events</title>
            <search>
                <query>index=_internal</query>
            </search>
        </chart>
    </row> 

    <row>
        <table>
            <title>Table</title>
            <search>
                <query>index=_internal</query>
            </search>  
        </table>
    </row>

</form>

However the output from showtoken.js is now:

$earliest$  0   0   undefined
$latest$            undefined
$num_of_days$   Last 90 days    Last 90 days    undefined

It appears that "Last 90 days" is not a valid choice, but if I try -90d@d I get the same results. It is as if the tokens are not setting correctly, or being interrupted properly.

What I am trying to accomplish is to have an input form that is called by several forms that require different default time frames for the time picker.

Any advice would be greatly appreciated!

[niketn · Accepted solution]

@yuanliu You can create your own Custom Time Range and make the same available in your App or Global.
Refer to following documentation for how you can create your own Preset Time Range: http://docs.splunk.com/Documentation/Splunk/latest/Search/Selecttimerangestoapply#Create_a_time_rang...

Last 30 days: earliest=-30d@d and latest=now, similarly you can created Last 90 days as: earliest=-90d@d and latest=now. Please try out and let us know.

Following are three steps for adding Time Range Last 90 Days in Splunk:

[bkcarter]

I could not get this to work for some reason. The new time range does not show up in the time picker.

[niketn]

@bkCheck the Access and Permission of Time range you have declared. This worked fine for me. Refer to attached screenshots. Please try out and accept the answer if this helps.

[bkcarter]

I tried all of the solutions offered, but this one seemed to accomplish what I needed the best. I simply added the time value using time.con, and it allowed the "Last 90 days" token value to take hold.

[yuanliu]

Splunk's fieldset tries to do some smart matching when possible. "Last 30 days" is a predefined token in Splunk's global time picker, so Splunk uses that information to reasonably guess that $earliest$ = -30d@d and $latest$ = now is your intention. There is no predefined "Last 90 days" so Splunk doesn't know what you mean by that. In Splunk 6, it is much easier to simply use time picker rather than use your own token definitions.

[bkcarter]

Ok, I was wondering if "Last 90 days" was an acceptable value. What I am trying to do is use the same form in two separate scenarios. One scenario needs the "default" time to be 30 days, and the other to be 90 days. When you say it is much easier to just use the time picker, how would you set that up?

Thanks!

[yuanliu]

If you use the dashboard GUI, you can "Add input" and select "time" (the last in drop-down). In Simple XML, it looks like

    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>

This is not to say that you cannot define custom tokens to achieve what you intend to do. It just requires a bit more work.

[bkcarter]

That is exactly what I want to do. I want to define a custom token that is passed down in a drill down from another form. I cannot seem to get the tokens passed, to take hold in the element. Is there a secret to using a token in and elements?

[yuanliu]

If you only use one time picker, there is no need to invoke tokens explicitly. In panel editor, there is a selection for "Time range". Use "Global" will do the job. In Simple XML, the codes in search are

          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>

If you really want, you can invoke these two tokens any way you see fit.

[bkcarter]

I should add that I am using Splunk Enterprise v6.5.3.