How to enable time range picker presets to be applied to my custom search command?

[km007d]

Hi,

I have built up a custom command in Splunk to search elastic search, but I found that I am unable to use the time range presets present in the dashboard right beside the search box. Changing the value to any time input doesn't make any change in my output. However, if I handle it through parameters in my search, it works fine. Here is a sample request from inspect job:

{
    "adhoc_search_level": "verbose", 
    "auto_cancel": "30", 
    "custom.dispatch.earliest_time": "-15m", 
    "custom.dispatch.latest_time": "now", 
    "custom.display.general.type": "statistics", 
    "custom.display.page.search.tab": "statistics", 
    "custom.display.visualizations.charting.chart": "pie", 
    "custom.search": "| es", 
    "earliest_time": "-15m", 
    "indexedRealtime": null, 
    "latest_time": "now", 
    "preview": "1", 
    "rf": "*", 
    "search": "| es", 
    "status_buckets": "300", 
    "ui_dispatch_app": "splunk-elasticsearch"
}

Even iI choose last 15 min here, the search returns me output for entire duration. My sample output looks like this:

_time                                                   -raw
2015-07-10 18:11:18 Jul 10 14:09:14 host-135-144-122-234 abrt: detected unhandled Python exception in 'test.python' l

[bmacias84]

I struggled with with elastic search and other tools. If this was a dashboard panel you could you Splunk webframe work with some js and get the information from the instance or from the search job and insert the time into the search query.

The idea would be to tag all your search with id with naming convention and have your JS script look for all ids contain <yoursearch>-elastic. Then loop through each splunk search instance, get the current search string, insert the time for your commands and finally run your search. Then you could generically apply this JS to any dashboard panel interchangeable.

var elastricSearches = $("[id^='_elastic']");
var searchInstance;
var searchQuery;
for (var i=0; i >= elastricSearches.length; i++) {
  searchInstance = splunkjs.mvc.Components.getInstance(elastricSearches[i].attr('id'));
  searchQuery = searchInstance.settings.get('search');
  /*
  insert code to parse out query and replace strings for time.
   */

  // now run search.
  searchInstance.set('search', searchQuery);
}

Just a thought.