Hi at all,
I tried to pass a token in a drilldown to another dashboard to the default values of the Time Picker but I received the message "invalid earliest_time".
In the Time Picker, I have "Custom time", and opening it, I have the token's names ($TimeFrom$ and $TimeTo$) instead of their values.
Replacing the token's names with the values I see in the Browser address bar (e.g. "-15m" and "now"), the search runs.
In other words: tokens are correctly passed to the secondary dashboard but values aren't being changed in the Time Picker. If instead, I pass my tokens to the dashboard's panels, they correctly run.
This is my code:
in the main dashboard:
<drilldown>
<link target="_blank">/app/my_app/home_page_overview_servers?TimeFrom=$Time.earliest$&TimeTo=$Time.latest$&System_Type=Server Windows&Stato=severe</link>
</drilldown>
In the secondary dashboard:
<input type="time" token="Time">
<label>Period</label>
<default>
<earliest>$TimeFrom$</earliest>
<latest>$TimeTo$</latest>
</default>
</input>
In other words, is it possible to pass a token to a Time Picker?
Bye.
Giuseppe
Hi at all,
I insert this solution that I received in .Conf18 that runs:
<panel>
<single>
<title>Server Down</title>
<search base="numero_server">
<query>
| where Total=0
| search Type="Server Windows"
| stats count
</query>
<progress>
<eval token="parsed.earliest">strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval>
<eval token="parsed.latest">strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval>
</progress>
</search>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="rangeColors">["0xd93f3c","0xd93f3c"]</option>
<option name="rangeValues">[0]</option>
<option name="useColors">1</option>
<drilldown>
<link target="_blank">/app/my_app/home_page_overview_servers?TimeFrom=$parsed.earliest$&TimeTo=$parsed.latest$</link>
</drilldown>
</single>
</panel>
Bye.
Giuseppe
Hi at all,
I insert this solution that I received in .Conf18 that runs:
<panel>
<single>
<title>Server Down</title>
<search base="numero_server">
<query>
| where Total=0
| search Type="Server Windows"
| stats count
</query>
<progress>
<eval token="parsed.earliest">strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval>
<eval token="parsed.latest">strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval>
</progress>
</search>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="rangeColors">["0xd93f3c","0xd93f3c"]</option>
<option name="rangeValues">[0]</option>
<option name="useColors">1</option>
<drilldown>
<link target="_blank">/app/my_app/home_page_overview_servers?TimeFrom=$parsed.earliest$&TimeTo=$parsed.latest$</link>
</drilldown>
</single>
</panel>
Bye.
Giuseppe
@cusello, I think you have almost got it. You can pass on earliest and latest time tokens from one dashboard to other. However, in your Dashboard QueryString seems like you are not using form tokens i.e. tokens prefixed with form.<inputTokenName>
So, instead of TimeFrom=$Time.earliest$&TimeTo=$Time.latest$&
you should use
form.TimeFrom=$Time.earliest$&form.TimeTo=$Time.latest$&
Also the remaining tokens passed from source dashboard to destination would also be form tokens so prefix form.<tokenName>
to all of the tokens. Please try out and confirm!
Splunk Dashboard Example App has an example of passing the token from Source to Destination dashboard as well.
I tried using form.TimeFrom and form.TimeTo, but the problem it's the same: it runs passing tokens to the panels, it doesn't run passing tokens to the Time Picker.
I have only a different message: "Search is waiting for input".
It seems that the Time Picker has a different behavior than the other inputs.
Thanks.
Bye.
Giuseppe
@cusello,
Its possible to pass the time token to another dashboard. Please try the below example.
Dashboard1
<form>
<label>Time Token</label>
<fieldset submitButton="false">
<input type="time" token="time_from_first_dashboard" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=_*|timechart count by sourcetype</query>
<earliest>$time_from_first_dashboard.earliest$</earliest>
<latest>$time_from_first_dashboard.latest$</latest>
</search>
<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">/app/search/time_second_dashboard?form.time_second_dashboard.earliest=$time_from_first_dashboard.earliest$&form.time_second_dashboard.latest=$time_from_first_dashboard.latest$</link>
</drilldown>
</table>
</panel>
</row>
</form>
On drilldown , the time parameters from dashboard1 is passed to Dashboard 2
Dashboard2
<form>
<label>Time_Second_Dashboard</label>
<fieldset submitButton="false">
<input type="time" token="time_second_dashboard">
<label>Time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=_*|stats count by sourcetype</query>
<earliest>$time_second_dashboard.earliest$</earliest>
<latest>$time_second_dashboard.latest$</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
Thank you very much for this post.
It fixed an issue I was struggling for days to fix.
Very easy to follow and can't miss anything.
I already found this solution and runs but it doesn't answer to my question because in this way you're passing the tokens directly to the panels, not to the Time Picker that maintains the default values you setted.
I want to pass the tokens to the Time Picker so I can have the values passed by the drilldown, but I can manually modify the value.
Thank you.
Bye.
Giuseppe
@cusello, Not really.
For e.g. I have set the default time on the second dashboard to last 15 minutes and it changes on my drilldown to the value passed from the first dashboard.
Try this
Please try and let's know if it doesn't work that way
This was my first solution, using the code in my question, but it doesn't run, I have the error message I described.
Maybe there's an error in my code, but in this way it doesn't run.
Bye.
Giuseppe