Hi.
How can I pass the time range selected in timerange picker to a drilldown form in Splunk 6.x Simple XML-based form ?
I've tried passing $earliest$ and $latest$ as described in Simple XML Reference) , but that passes only the time range of the timechart bin I've clicked on.
Form example:
<form>
<label>Timechart for drilldown</label>
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true">
<default>
<earliestTime>-7d@h</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
</fieldset>
<row>
<chart>
<searchString>index=_internal source=*metrics.log group=per_sourcetype_thruput | timechart sum(kb) AS "KB" by series</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<option name="charting.chart">column</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.drilldown">all</option>
<drilldown target="new">
<link>
<![CDATA[/app/search/test_drilldown?earliest=$earliest$&latest=$latest$]]>
</link>
</drilldown>
</chart>
</row>
</form>
Try this:
Changes - defined token for timerangepicker and used it along with token name where it was/has to be referenced.
<form>
<label>Timechart for drilldown</label>
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true" token="dashboardTime">
<default>
<earliestTime>-7d@h</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
</fieldset>
<row>
<chart>
<searchString>index=_internal source=*metrics.log group=per_sourcetype_thruput | timechart sum(kb) AS "KB" by series</searchString>
<earliestTime>$dashboardTime.earliest$</earliestTime>
<latestTime>$dashboardTime.latest$</latestTime>
<option name="charting.chart">column</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.drilldown">all</option>
<drilldown target="new">
<link>
<![CDATA[/app/search/test_drilldown?earliest=$dashboardTime.earliest$&latest=$dashboardTime.latest$]]>
</link>
</drilldown>
</chart>
</row>
</form>
Try this:
Changes - defined token for timerangepicker and used it along with token name where it was/has to be referenced.
<form>
<label>Timechart for drilldown</label>
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true" token="dashboardTime">
<default>
<earliestTime>-7d@h</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
</fieldset>
<row>
<chart>
<searchString>index=_internal source=*metrics.log group=per_sourcetype_thruput | timechart sum(kb) AS "KB" by series</searchString>
<earliestTime>$dashboardTime.earliest$</earliestTime>
<latestTime>$dashboardTime.latest$</latestTime>
<option name="charting.chart">column</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.drilldown">all</option>
<drilldown target="new">
<link>
<![CDATA[/app/search/test_drilldown?earliest=$dashboardTime.earliest$&latest=$dashboardTime.latest$]]>
</link>
</drilldown>
</chart>
</row>
</form>
Is it possible to pass an input token and the time range picker time?