Dashboards & Visualizations

Panel not updating when changing the time range picker

Explorer

Hi,

Backstory:
I'm trying to create 2 dashboards with 1 time range picker. Panel #1 uses the default time using the time range picker and Panel #2 will show the exact same time range but 1 week ago using other tokens defined in the time range picker.

I seem to have an issue with the time range picker and updating the panel #2 when i change the time. When i first start the dashboard, the dashboard will run correctly. But when i go to change the time again, panel #2 doesn't update. And when i go to change the time again, panel #2 will display the results from the previous time.

Any ideas?

Below is the code i have:

<fieldset submitButton="false" autoRun="true">
     <input type="time" token="time" searchWhenChanged="true">
       <label>Current Time</label>
       <default>
         <earliest>1501034400</earliest>
         <latest>1501120800</latest>
       </default>
       <change>
         <eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
         <eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
       </change>
     </input>

         <title>Panel#1</title>
         <search>
           <query>`search string`</query>
           <earliest>$time.earliest$</earliest>
           <latest>$time.latest$</latest>
         </search>

 <title>Panel#2</title>
         <search>
           <query>`search string`</query>
           <earliest>$earliest_offset$</earliest>
           <latest>$latest_offset$</latest>
         </search>
0 Karma
1 Solution

Legend

Feed the earliest and latest tokens to dummy search to perform eval to set relative_time.

  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Current Time</label>
      <default>
        <earliest>1501034400</earliest>
        <latest>1501120800</latest>
      </default>
    </input>
  </fieldset>
  <search>
    <query>| makeresults
    | eval EarliestTime=$time.earliest$
    </query>
    <progress>
      <eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
      <eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
    </progress>
  </search>
  <row>
    <panel>
      <html>
        <div>earliest_offset: $earliest_offset$</div>
        <div>latest_offset: $latest_offset$</div>
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Motivator

<form>
<label>testtr</label>
<fieldset submitButton="false">
<input type="time" token="time_tok">
<label>select a time range</label>
<default>
<earliest>1501034400</earliest>
<latest>1501120800</latest>
</default>
<change>
<eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
<eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=_internal group=pipeline</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
</table>
</panel>
</row>
<row>
<panel>
<table depends="$earliest_offset$,$latest_offset$">
<search>
<query>index=_internal group=pipeline earliest=$earliest_offset$ latest=$latest_offset$</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
</table>
</panel>
</row>
</form>

0 Karma

Explorer

Thanks sbbadri for your response. I'll give yours a try also.

0 Karma

Legend

Feed the earliest and latest tokens to dummy search to perform eval to set relative_time.

  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Current Time</label>
      <default>
        <earliest>1501034400</earliest>
        <latest>1501120800</latest>
      </default>
    </input>
  </fieldset>
  <search>
    <query>| makeresults
    | eval EarliestTime=$time.earliest$
    </query>
    <progress>
      <eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
      <eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
    </progress>
  </search>
  <row>
    <panel>
      <html>
        <div>earliest_offset: $earliest_offset$</div>
        <div>latest_offset: $latest_offset$</div>
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Explorer

Thanks niketnilay!! I added below and it worked.

<search>
     <query>| makeresults
     | eval EarliestTime=$time.earliest$
     </query>
     <progress>
       <eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
       <eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
     </progress>
   </search>

Why does it need to be added to a dummy search first?

0 Karma

Legend

For two reasons, the time earliest and latest provided by time control as snap to time which is being used by the relative_time() function to generate new time.

Dummy search has been made depended on time input token to make sure it resets every time time changes in the input.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!