Check the code attached below.
default time = 1 week window. Setting the drop-down label to "time_selected" token.
set token="time_selected" ==> $label$
When i open the dashboard, $timeselected$ = $label$
When i change the Time to (1 week window or All time), $timeselected$ = 1 week window.
By default we set the time to 1 week window, but $label$ token is not set.
When we change the time, it's working fine.
it to work by default.
When i open the dashboard, $time_selected$ should be "1 week window"
Any help is appreciated!
I am not sure that the realtime search times are supported in simple XML. Did you really want a realtime search in your dashboard?
Yes. We need a live dashboard.
Real time search is working fine. But the only issue is label is not setting on load of dashboard.
Its working fine, when we change it.
If what you are doing would work (which I am not sure it will) , you need to add the "condition" xml element.
<change> <condition label="*"> <set token="time_selected">$label$</set> </condition> </change>
The other thing to try is anywhere you have $time_selected$ in the dashboard, substitute it with $form.globalTime$. Still not confident it is possible, but are the only two things I can think of.
The code in your question works for me Splunk 6.5. Here is the code that I used to test (run anywhere sample). What version of Splunk you're on?
<form> <label>TestsrchFilter</label> <fieldset submitButton="false"> <input type="time" token="time" searchWhenChanged="true"> <label>Select Time</label> <default> <earliest>rt-1w</earliest> <latest>rtnow</latest> </default> <change> <set token="selected_time">$label$</set> </change> </input> </fieldset> <row> <panel> <title>$selected_time$</title> <table> <search> <query>index=_internal | timechart span=1h count</query> <earliest>-15m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form>