Dashboards & Visualizations

How to prevent drop-down form element from using timerangepicker in search?

kb_vells
Path Finder

index=indexApp with field "officer"
index=indexTeam with fields "officer" and "team id"

indexTeam has been created on 14 August 2014 but the indexApp was created around 2 months ago. I have "team id" drop-down in my dashboard which is used for applying filtering on my dashboard panels. when I use alltime in timerangepicker search, the drop-down is populated with list of teams but when I change the filter to 24hours or yesterday or previous week, the drop-down is empty. The error occurred on 15 Aug 2014. I think the error is related to indexTeam involved in timerangepicker search where index is created only on 14 August. Is there any way to tell drop-down search not to use timerangepicker.

<form>
  <label>App by Team</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">

    <input type="time" searchWhenChanged="true">
      <label>Time period</label>
      <default/>
    </input>

    <input type="dropdown" token="teamId">
      <label>Team Id</label>
      <prefix>"team id"="</prefix>
      <suffix>"</suffix>
      <populatingSearch fieldForValue="team id" fieldForLabel="team id">
        <![CDATA[index=indexTeam |dedup "team id"|sort "team id"]]>
      </populatingSearch>
      <default/>
      <choice value="">All</choice>
    </input>
1 Solution

somesoni2
Revered Legend

You can add earliest and latest in the base search of your populatingSearch query for dropdown to override the effect of timerangepicker.

e.g. Instead of this (which will with its timerange set from parent timerangepicker)

index=indexTeam |dedup "team id"|sort "team id"

use this.

index=indexTeam latest=now|dedup "team id"|sort "team id"

View solution in original post

somesoni2
Revered Legend

You can add earliest and latest in the base search of your populatingSearch query for dropdown to override the effect of timerangepicker.

e.g. Instead of this (which will with its timerange set from parent timerangepicker)

index=indexTeam |dedup "team id"|sort "team id"

use this.

index=indexTeam latest=now|dedup "team id"|sort "team id"

kb_vells
Path Finder

Absolutely Brilliant Somesh, You saved my day. The fix works perfectly.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...