Dashboards & Visualizations
Highlighted

Is it possible to pass a token to a time picker?

Legend

Hi at all,
I tried to pass a token in a drilldown to another dashboard to the default values of the Time Picker but I received the message "invalid earliest_time".

In the Time Picker, I have "Custom time", and opening it, I have the token's names ($TimeFrom$ and $TimeTo$) instead of their values.

Replacing the token's names with the values I see in the Browser address bar (e.g. "-15m" and "now"), the search runs.

In other words: tokens are correctly passed to the secondary dashboard but values aren't being changed in the Time Picker. If instead, I pass my tokens to the dashboard's panels, they correctly run.

This is my code:
in the main dashboard:

<drilldown>
  <link target="_blank">/app/my_app/home_page_overview_servers?TimeFrom=$Time.earliest$&amp;TimeTo=$Time.latest$&amp;System_Type=Server Windows&amp;Stato=severe</link>
</drilldown>

In the secondary dashboard:

<input type="time" token="Time">
  <label>Period</label>
  <default>
    <earliest>$TimeFrom$</earliest>
    <latest>$TimeTo$</latest>
  </default>
</input>

In other words, is it possible to pass a token to a Time Picker?

Bye.
Giuseppe

0 Karma
Highlighted

Re: Is it possible to pass a token to a time picker?

SplunkTrust
SplunkTrust

@cusello,

Its possible to pass the time token to another dashboard. Please try the below example.

Dashboard1

<form>
  <label>Time Token</label>
  <fieldset submitButton="false">
    <input type="time" token="time_from_first_dashboard" searchWhenChanged="true">
      <label>Time</label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_*|timechart count by sourcetype</query>
          <earliest>$time_from_first_dashboard.earliest$</earliest>
          <latest>$time_from_first_dashboard.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <link target="_blank">/app/search/time_second_dashboard?form.time_second_dashboard.earliest=$time_from_first_dashboard.earliest$&amp;form.time_second_dashboard.latest=$time_from_first_dashboard.latest$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

On drilldown , the time parameters from dashboard1 is passed to Dashboard 2

Dashboard2

<form>
  <label>Time_Second_Dashboard</label>
  <fieldset submitButton="false">
    <input type="time" token="time_second_dashboard">
      <label>Time</label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_*|stats count by sourcetype</query>
          <earliest>$time_second_dashboard.earliest$</earliest>
          <latest>$time_second_dashboard.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Highlighted

Re: Is it possible to pass a token to a time picker?

Legend

I already found this solution and runs but it doesn't answer to my question because in this way you're passing the tokens directly to the panels, not to the Time Picker that maintains the default values you setted.
I want to pass the tokens to the Time Picker so I can have the values passed by the drilldown, but I can manually modify the value.

Thank you.
Bye.
Giuseppe

0 Karma
Highlighted

Re: Is it possible to pass a token to a time picker?

SplunkTrust
SplunkTrust

@cusello, Not really.
For e.g. I have set the default time on the second dashboard to last 15 minutes and it changes on my drilldown to the value passed from the first dashboard.

Try this

  • Set second dashboard default time to 15 minutes and also select 15 minutes
  • Set the time range for the first dashboard to 24 hours and click on the table planel
  • On drilldown to the second dashboard, you should be able to see the time input dropdown to 24 hours which was passed from first dashboard.

Please try and let's know if it doesn't work that way

0 Karma
Highlighted

Re: Is it possible to pass a token to a time picker?

Legend

This was my first solution, using the code in my question, but it doesn't run, I have the error message I described.
Maybe there's an error in my code, but in this way it doesn't run.
Bye.
Giuseppe

0 Karma
Highlighted

Re: Is it possible to pass a token to a time picker?

Legend

@cusello, I think you have almost got it. You can pass on earliest and latest time tokens from one dashboard to other. However, in your Dashboard QueryString seems like you are not using form tokens i.e. tokens prefixed with form.<inputTokenName>

So, instead of TimeFrom=$Time.earliest$&amp;TimeTo=$Time.latest$&amp; you should use

form.TimeFrom=$Time.earliest$&amp;form.TimeTo=$Time.latest$&amp;

Also the remaining tokens passed from source dashboard to destination would also be form tokens so prefix form.<tokenName> to all of the tokens. Please try out and confirm!

Splunk Dashboard Example App has an example of passing the token from Source to Destination dashboard as well.

0 Karma
Highlighted

Re: Is it possible to pass a token to a time picker?

Legend

I tried using form.TimeFrom and form.TimeTo, but the problem it's the same: it runs passing tokens to the panels, it doesn't run passing tokens to the Time Picker.
I have only a different message: "Search is waiting for input".

It seems that the Time Picker has a different behavior than the other inputs.

Thanks.
Bye.
Giuseppe

0 Karma
Highlighted

Re: Is it possible to pass a token to a time picker?

Legend

Hi at all,
I insert this solution that I received in .Conf18 that runs:

<panel>
  <single>
    <title>Server Down</title>
    <search base="numero_server">
      <query>
        | where Total=0
        | search Type="Server Windows"
        | stats count
      </query>
      <progress>
        <eval token="parsed.earliest">strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval>
        <eval token="parsed.latest">strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval>
      </progress>
    </search>
    <option name="colorMode">block</option>
    <option name="drilldown">all</option>
    <option name="rangeColors">["0xd93f3c","0xd93f3c"]</option>
    <option name="rangeValues">[0]</option>
    <option name="useColors">1</option>
    <drilldown>
      <link target="_blank">/app/my_app/home_page_overview_servers?TimeFrom=$parsed.earliest$&amp;TimeTo=$parsed.latest$</link>
    </drilldown>
  </single>
</panel>

Bye.
Giuseppe

View solution in original post

0 Karma