Dashboards & Visualizations

How to prevent drop-down form element from using timerangepicker in search?

kb_vells
Path Finder

index=indexApp with field "officer"
index=indexTeam with fields "officer" and "team id"

indexTeam has been created on 14 August 2014 but the indexApp was created around 2 months ago. I have "team id" drop-down in my dashboard which is used for applying filtering on my dashboard panels. when I use alltime in timerangepicker search, the drop-down is populated with list of teams but when I change the filter to 24hours or yesterday or previous week, the drop-down is empty. The error occurred on 15 Aug 2014. I think the error is related to indexTeam involved in timerangepicker search where index is created only on 14 August. Is there any way to tell drop-down search not to use timerangepicker.

<form>
  <label>App by Team</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">

    <input type="time" searchWhenChanged="true">
      <label>Time period</label>
      <default/>
    </input>

    <input type="dropdown" token="teamId">
      <label>Team Id</label>
      <prefix>"team id"="</prefix>
      <suffix>"</suffix>
      <populatingSearch fieldForValue="team id" fieldForLabel="team id">
        <![CDATA[index=indexTeam |dedup "team id"|sort "team id"]]>
      </populatingSearch>
      <default/>
      <choice value="">All</choice>
    </input>
1 Solution

somesoni2
Revered Legend

You can add earliest and latest in the base search of your populatingSearch query for dropdown to override the effect of timerangepicker.

e.g. Instead of this (which will with its timerange set from parent timerangepicker)

index=indexTeam |dedup "team id"|sort "team id"

use this.

index=indexTeam latest=now|dedup "team id"|sort "team id"

View solution in original post

somesoni2
Revered Legend

You can add earliest and latest in the base search of your populatingSearch query for dropdown to override the effect of timerangepicker.

e.g. Instead of this (which will with its timerange set from parent timerangepicker)

index=indexTeam |dedup "team id"|sort "team id"

use this.

index=indexTeam latest=now|dedup "team id"|sort "team id"

kb_vells
Path Finder

Absolutely Brilliant Somesh, You saved my day. The fix works perfectly.

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...