We have a dashboard panel table that contains links to dashboard "snapshots" like this:
http://...?form.field1.earliest=1505343600&form.field1.latest=1505354400
On the dashboard we have a panel that has external hyperlinks which need dynamic timestamps as well. In order to create those timestamps we have the following code in the form section of our dashboard:
<input type="time" token="field1">
<label></label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
<change>
<condition match="isnum($earliest$) OR isnum($latest$)">
<eval token="stime">strftime('earliest',"%m/%d/%y %H:%M:%S"</eval>
<eval token="etime">strftime('latest',"%m/%d/%y %H:%M:%S"</eval>
<eval token="etime_NR">'latest'+3600</eval>
<eval token="duration_NR">$latest$-$earliest$+7200</eval>
</condition>
</change>
</input>
This code works fine if I am coming into the dashboard directly and use the date picker to select earliest/latest. If I come to the dashboard via a link like above, the variables stime/etime/etime_NR/duration_NR are not set. Ideas?
So I am going to answer my own question. This is probably bad etiquette on Splunk Answers. Willing to handle correctly if someone points out how I should do that...
The problem is with my defaults on the form for earliest/latest. They are conflicting with what is passed on the URL. Removing those defaults seems to allow everything to flow through as expected.
So I am going to answer my own question. This is probably bad etiquette on Splunk Answers. Willing to handle correctly if someone points out how I should do that...
The problem is with my defaults on the form for earliest/latest. They are conflicting with what is passed on the URL. Removing those defaults seems to allow everything to flow through as expected.
Hey @mschellhouse, If you have a question, share it with the community, then find a solution, then you should accept your own answer. 🙂 There will be more info as this is edited over time, but you can always reference the Answers documentation as well if you have questions about etiquette. http://docs.splunk.com/Documentation/Community/latest/community/AboutCommunity Happy Splunking!