Dashboards & Visualizations

Time picker on form is not honored in "open in search" click

bwooden
Splunk Employee
Splunk Employee

I have a page that renders a search based on user selected time. If the user selects a specific time range, receives results, then clicks the magnifying glass icon (i.e. "Open in Search") the search is rendered against all time, not the time they originally picked. How do I get the automatic "Open in Search" drilldown to respect the user's selected time?

Generic repro:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime></earliestTime>
        <latestTime></latestTime>
      </event>
    </panel>
  </row>
</form>
1 Solution

bwooden
Splunk Employee
Splunk Employee

Update the earliestTime and latestTime to reflect the time chosen by the user. The form's input supports a token that can be used for that reference.

Example:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
      </event>
    </panel>
  </row>
</form>

View solution in original post

bwooden
Splunk Employee
Splunk Employee

Update the earliestTime and latestTime to reflect the time chosen by the user. The form's input supports a token that can be used for that reference.

Example:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
      </event>
    </panel>
  </row>
</form>

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!