How to sync input field values using a token to all the dashboard panels?

[Hemnaath]

Hi, We have a created a dashboard with multiple panels and one input text tokens, another with Time Picker. But it is not working as expected. Below are the two input fields used as the input to the search string defined in all the dashboard panels.

Dashboard Input Fields
- Username:
- Time Picker:

Exact Requirement:
When user feeds the value into text input fields “username” and selects the Time picker drop down menu, all the dashboard should sync and populate the information based on the user inputs and for the selected duration.

Problem Details:
Currently only the username input token is synchronizing with all the dashboards, but when the user trying to select the Time Picker it’s not synchronized. Instead it populate only the default 24 hours information.

Example:

SPL: 
| inputlookup TES-CND-CTX-IDENTITY-AD.csv | search identity ="$F$" , $T$ |  stats count by first| table first

Query Details:

The above lookup table contains the filed called identity where all the user ID is reflected, so we have created a token called “F” and applied in the search and we are able to fetch the user name details. Similarly when the user is trying to select the Time from the time picker for the particular user input, it is not working, we are getting the default value result for 24 hours. Though we have defined the token as $T$ and search on change option is checked.

Kindly guide me how to fix this issue.

[xpac · Accepted solution]

Hey,

a shared timepicker is possible, but a little different to implement.
Take a look at this document: Create dashboards and panels
Search for "shared timepicker", you'll find a tutorial on how to add a shared timepicker and connect it to your panels.

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

[Hemnaath]

Thanks xpac, it worked, i found the mistake in the query. I had included the token $T$ in the query and due to which splunk had an issue in synchronizing data and included the shared timepicker option in all the dashboard search string.

Old query.
| inputlookup TES-CND-CTX-IDENTITY-AD.csv | search identity ="$F$" , $T$ |  stats count by first| table first 

Corrected Query: 

| inputlookup TES-CND-CTX-IDENTITY-AD.csv | search identity ="$F$"  |  stats count by first| table first

and included the Shared timepicker option. After this correction, we could see the data are synchronizing as per the user inputs.