Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Panel not updating when changing the time range pi...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Backstory:
I'm trying to create 2 dashboards with 1 time range picker. Panel #1 uses the default time using the time range picker and Panel #2 will show the exact same time range but 1 week ago using other tokens defined in the time range picker.
I seem to have an issue with the time range picker and updating the panel #2 when i change the time. When i first start the dashboard, the dashboard will run correctly. But when i go to change the time again, panel #2 doesn't update. And when i go to change the time again, panel #2 will display the results from the previous time.
Any ideas?
Below is the code i have:
<fieldset submitButton="false" autoRun="true">
<input type="time" token="time" searchWhenChanged="true">
<label>Current Time</label>
<default>
<earliest>1501034400</earliest>
<latest>1501120800</latest>
</default>
<change>
<eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
<eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
</change>
</input>
<title>Panel#1</title>
<search>
<query>`search string`</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<title>Panel#2</title>
<search>
<query>`search string`</query>
<earliest>$earliest_offset$</earliest>
<latest>$latest_offset$</latest>
</search>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Feed the earliest and latest tokens to dummy search to perform eval to set relative_time.
<fieldset submitButton="false" autoRun="true">
<input type="time" token="time" searchWhenChanged="true">
<label>Current Time</label>
<default>
<earliest>1501034400</earliest>
<latest>1501120800</latest>
</default>
</input>
</fieldset>
<search>
<query>| makeresults
| eval EarliestTime=$time.earliest$
</query>
<progress>
<eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
<eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
</progress>
</search>
<row>
<panel>
<html>
<div>earliest_offset: $earliest_offset$</div>
<div>latest_offset: $latest_offset$</div>
</html>
</panel>
</row>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
<form>
<label>testtr</label>
<fieldset submitButton="false">
<input type="time" token="time_tok">
<label>select a time range</label>
<default>
<earliest>1501034400</earliest>
<latest>1501120800</latest>
</default>
<change>
<eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
<eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=_internal group=pipeline</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
</table>
</panel>
</row>
<row>
<panel>
<table depends="$earliest_offset$,$latest_offset$">
<search>
<query>index=_internal group=pipeline earliest=$earliest_offset$ latest=$latest_offset$</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
</table>
</panel>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks sbbadri for your response. I'll give yours a try also.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Feed the earliest and latest tokens to dummy search to perform eval to set relative_time.
<fieldset submitButton="false" autoRun="true">
<input type="time" token="time" searchWhenChanged="true">
<label>Current Time</label>
<default>
<earliest>1501034400</earliest>
<latest>1501120800</latest>
</default>
</input>
</fieldset>
<search>
<query>| makeresults
| eval EarliestTime=$time.earliest$
</query>
<progress>
<eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
<eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
</progress>
</search>
<row>
<panel>
<html>
<div>earliest_offset: $earliest_offset$</div>
<div>latest_offset: $latest_offset$</div>
</html>
</panel>
</row>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks niketnilay!! I added below and it worked.
<search>
<query>| makeresults
| eval EarliestTime=$time.earliest$
</query>
<progress>
<eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
<eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
</progress>
</search>
Why does it need to be added to a dummy search first?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
For two reasons, the time earliest and latest provided by time control as snap to time which is being used by the relative_time() function to generate new time.
Dummy search has been made depended on time input token to make sure it resets every time time changes in the input.
| makeresults | eval message= "Happy Splunking!!!"
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
