Dashboards & Visualizations

Time picker on form is not honored in "open in search" click

bwooden
Splunk Employee
Splunk Employee

I have a page that renders a search based on user selected time. If the user selects a specific time range, receives results, then clicks the magnifying glass icon (i.e. "Open in Search") the search is rendered against all time, not the time they originally picked. How do I get the automatic "Open in Search" drilldown to respect the user's selected time?

Generic repro:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime></earliestTime>
        <latestTime></latestTime>
      </event>
    </panel>
  </row>
</form>
1 Solution

bwooden
Splunk Employee
Splunk Employee

Update the earliestTime and latestTime to reflect the time chosen by the user. The form's input supports a token that can be used for that reference.

Example:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
      </event>
    </panel>
  </row>
</form>

View solution in original post

bwooden
Splunk Employee
Splunk Employee

Update the earliestTime and latestTime to reflect the time chosen by the user. The form's input supports a token that can be used for that reference.

Example:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
      </event>
    </panel>
  </row>
</form>
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...