Dashboards & Visualizations

Time picker on form is not honored in "open in search" click

bwooden
Splunk Employee
Splunk Employee

I have a page that renders a search based on user selected time. If the user selects a specific time range, receives results, then clicks the magnifying glass icon (i.e. "Open in Search") the search is rendered against all time, not the time they originally picked. How do I get the automatic "Open in Search" drilldown to respect the user's selected time?

Generic repro:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime></earliestTime>
        <latestTime></latestTime>
      </event>
    </panel>
  </row>
</form>
1 Solution

bwooden
Splunk Employee
Splunk Employee

Update the earliestTime and latestTime to reflect the time chosen by the user. The form's input supports a token that can be used for that reference.

Example:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
      </event>
    </panel>
  </row>
</form>

View solution in original post

bwooden
Splunk Employee
Splunk Employee

Update the earliestTime and latestTime to reflect the time chosen by the user. The form's input supports a token that can be used for that reference.

Example:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
      </event>
    </panel>
  </row>
</form>
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...