Dashboards & Visualizations

Passing selected time range to drilldown in Simple XML

Path Finder

Hi.

How can I pass the time range selected in timerange picker to a drilldown form in Splunk 6.x Simple XML-based form ?
I've tried passing $earliest$ and $latest$ as described in Simple XML Reference) , but that passes only the time range of the timechart bin I've clicked on.

Form example:

<form>
    <label>Timechart for drilldown</label>
    <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default>
        <earliestTime>-7d@h</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    </fieldset>
    <row>
    <chart>
      <searchString>index=_internal source=*metrics.log group=per_sourcetype_thruput | timechart sum(kb) AS "KB" by series</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
      <option name="charting.chart">column</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.drilldown">all</option>
      <drilldown target="new">
        <link>
          <![CDATA[/app/search/test_drilldown?earliest=$earliest$&latest=$latest$]]>
        </link>
      </drilldown>
    </chart>
    </row>
</form>
Tags (2)
1 Solution

Revered Legend

Try this:
Changes - defined token for timerangepicker and used it along with token name where it was/has to be referenced.

<form>
    <label>Timechart for drilldown</label>
    <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true" token="dashboardTime">
      <default>
        <earliestTime>-7d@h</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    </fieldset>
    <row>
    <chart>
      <searchString>index=_internal source=*metrics.log group=per_sourcetype_thruput | timechart sum(kb) AS "KB" by series</searchString>
      <earliestTime>$dashboardTime.earliest$</earliestTime>
      <latestTime>$dashboardTime.latest$</latestTime>
      <option name="charting.chart">column</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.drilldown">all</option>
      <drilldown target="new">
        <link>
          <![CDATA[/app/search/test_drilldown?earliest=$dashboardTime.earliest$&latest=$dashboardTime.latest$]]>
        </link>
      </drilldown>
    </chart>
    </row>
</form>

View solution in original post

Revered Legend

Try this:
Changes - defined token for timerangepicker and used it along with token name where it was/has to be referenced.

<form>
    <label>Timechart for drilldown</label>
    <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true" token="dashboardTime">
      <default>
        <earliestTime>-7d@h</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    </fieldset>
    <row>
    <chart>
      <searchString>index=_internal source=*metrics.log group=per_sourcetype_thruput | timechart sum(kb) AS "KB" by series</searchString>
      <earliestTime>$dashboardTime.earliest$</earliestTime>
      <latestTime>$dashboardTime.latest$</latestTime>
      <option name="charting.chart">column</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.drilldown">all</option>
      <drilldown target="new">
        <link>
          <![CDATA[/app/search/test_drilldown?earliest=$dashboardTime.earliest$&latest=$dashboardTime.latest$]]>
        </link>
      </drilldown>
    </chart>
    </row>
</form>

View solution in original post

Communicator

Is it possible to pass an input token and the time range picker time?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!