Handling dashboard parameters passed in from link

[mschellhouse]

We have a dashboard panel table that contains links to dashboard "snapshots" like this:
http://...?form.field1.earliest=1505343600&form.field1.latest=1505354400

On the dashboard we have a panel that has external hyperlinks which need dynamic timestamps as well. In order to create those timestamps we have the following code in the form section of our dashboard:

<input type="time" token="field1">
  <label></label>
  <default>
    <earliest>-1d@d</earliest>
    <latest>@d</latest>
  </default>
  <change>
     <condition match="isnum($earliest$) OR isnum($latest$)">
       <eval token="stime">strftime('earliest',"%m/%d/%y %H:%M:%S"</eval>
       <eval token="etime">strftime('latest',"%m/%d/%y %H:%M:%S"</eval>
       <eval token="etime_NR">'latest'+3600</eval>
      <eval token="duration_NR">$latest$-$earliest$+7200</eval>
     </condition>
  </change>
</input>

This code works fine if I am coming into the dashboard directly and use the date picker to select earliest/latest. If I come to the dashboard via a link like above, the variables stime/etime/etime_NR/duration_NR are not set. Ideas?

[mschellhouse · Accepted solution]

So I am going to answer my own question. This is probably bad etiquette on Splunk Answers. Willing to handle correctly if someone points out how I should do that...

The problem is with my defaults on the form for earliest/latest. They are conflicting with what is passed on the URL. Removing those defaults seems to allow everything to flow through as expected.

[lfedak_splunk]

Hey @mschellhouse, If you have a question, share it with the community, then find a solution, then you should accept your own answer. 🙂 There will be more info as this is edited over time, but you can always reference the Answers documentation as well if you have questions about etiquette. http://docs.splunk.com/Documentation/Community/latest/community/AboutCommunity Happy Splunking!