Dashboards & Visualizations

How to prevent drop-down form element from using timerangepicker in search?

kb_vells
Path Finder

index=indexApp with field "officer"
index=indexTeam with fields "officer" and "team id"

indexTeam has been created on 14 August 2014 but the indexApp was created around 2 months ago. I have "team id" drop-down in my dashboard which is used for applying filtering on my dashboard panels. when I use alltime in timerangepicker search, the drop-down is populated with list of teams but when I change the filter to 24hours or yesterday or previous week, the drop-down is empty. The error occurred on 15 Aug 2014. I think the error is related to indexTeam involved in timerangepicker search where index is created only on 14 August. Is there any way to tell drop-down search not to use timerangepicker.

<form>
  <label>App by Team</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">

    <input type="time" searchWhenChanged="true">
      <label>Time period</label>
      <default/>
    </input>

    <input type="dropdown" token="teamId">
      <label>Team Id</label>
      <prefix>"team id"="</prefix>
      <suffix>"</suffix>
      <populatingSearch fieldForValue="team id" fieldForLabel="team id">
        <![CDATA[index=indexTeam |dedup "team id"|sort "team id"]]>
      </populatingSearch>
      <default/>
      <choice value="">All</choice>
    </input>
1 Solution

somesoni2
Revered Legend

You can add earliest and latest in the base search of your populatingSearch query for dropdown to override the effect of timerangepicker.

e.g. Instead of this (which will with its timerange set from parent timerangepicker)

index=indexTeam |dedup "team id"|sort "team id"

use this.

index=indexTeam latest=now|dedup "team id"|sort "team id"

View solution in original post

somesoni2
Revered Legend

You can add earliest and latest in the base search of your populatingSearch query for dropdown to override the effect of timerangepicker.

e.g. Instead of this (which will with its timerange set from parent timerangepicker)

index=indexTeam |dedup "team id"|sort "team id"

use this.

index=indexTeam latest=now|dedup "team id"|sort "team id"

kb_vells
Path Finder

Absolutely Brilliant Somesh, You saved my day. The fix works perfectly.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...