Dashboards & Visualizations

How to create two date input fields to use as parameters for a query in an XML form?

gjohnson
New Member

I am trying to create an XML form in a dashboard that takes shows all tickets in a ticket system that fall between two dates. First problem is there doesn't seem to be a simple date picker, so I put a date time selector on the form. The second problem is that when I try to use the Between function of the Date Time custom selection it always fails with an error stating "Earliest time cannot be greater than latest time. "

So my question is, how do I create two date input fields (begindate and enddate) that I can use as parameters in a query such as

... | WHERE DateOpened > begindate AND DateOpened < enddate

I have tried using the and parameters under the , but they don't seem to function properly when I have a date picker... Any help would be appreciated.

Tags (4)
0 Karma

mw
Splunk Employee
Splunk Employee

You don't actually need two different time pickers to do this. One will allow you to select any slice of time imaginable. Basically, you would just edit the dashboard, add a time picker, then for each element in the dashboard ensure that the time used for the search will be the time chosen with the picker instead of the existing time selection for the search. Here's the doc link: http://docs.splunk.com/Documentation/Splunk/6.1.3/Viz/FormEditor#Add_a_time_input_to_a_form . Hope that helps.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...