Dashboards & Visualizations

How to prevent drop-down form element from using timerangepicker in search?

kb_vells
Path Finder

index=indexApp with field "officer"
index=indexTeam with fields "officer" and "team id"

indexTeam has been created on 14 August 2014 but the indexApp was created around 2 months ago. I have "team id" drop-down in my dashboard which is used for applying filtering on my dashboard panels. when I use alltime in timerangepicker search, the drop-down is populated with list of teams but when I change the filter to 24hours or yesterday or previous week, the drop-down is empty. The error occurred on 15 Aug 2014. I think the error is related to indexTeam involved in timerangepicker search where index is created only on 14 August. Is there any way to tell drop-down search not to use timerangepicker.

<form>
  <label>App by Team</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">

    <input type="time" searchWhenChanged="true">
      <label>Time period</label>
      <default/>
    </input>

    <input type="dropdown" token="teamId">
      <label>Team Id</label>
      <prefix>"team id"="</prefix>
      <suffix>"</suffix>
      <populatingSearch fieldForValue="team id" fieldForLabel="team id">
        <![CDATA[index=indexTeam |dedup "team id"|sort "team id"]]>
      </populatingSearch>
      <default/>
      <choice value="">All</choice>
    </input>
1 Solution

somesoni2
Revered Legend

You can add earliest and latest in the base search of your populatingSearch query for dropdown to override the effect of timerangepicker.

e.g. Instead of this (which will with its timerange set from parent timerangepicker)

index=indexTeam |dedup "team id"|sort "team id"

use this.

index=indexTeam latest=now|dedup "team id"|sort "team id"

View solution in original post

somesoni2
Revered Legend

You can add earliest and latest in the base search of your populatingSearch query for dropdown to override the effect of timerangepicker.

e.g. Instead of this (which will with its timerange set from parent timerangepicker)

index=indexTeam |dedup "team id"|sort "team id"

use this.

index=indexTeam latest=now|dedup "team id"|sort "team id"

kb_vells
Path Finder

Absolutely Brilliant Somesh, You saved my day. The fix works perfectly.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...