Dashboards & Visualizations

Time picker on form is not honored in "open in search" click

bwooden
Splunk Employee
Splunk Employee

I have a page that renders a search based on user selected time. If the user selects a specific time range, receives results, then clicks the magnifying glass icon (i.e. "Open in Search") the search is rendered against all time, not the time they originally picked. How do I get the automatic "Open in Search" drilldown to respect the user's selected time?

Generic repro:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime></earliestTime>
        <latestTime></latestTime>
      </event>
    </panel>
  </row>
</form>
1 Solution

bwooden
Splunk Employee
Splunk Employee

Update the earliestTime and latestTime to reflect the time chosen by the user. The form's input supports a token that can be used for that reference.

Example:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
      </event>
    </panel>
  </row>
</form>

View solution in original post

bwooden
Splunk Employee
Splunk Employee

Update the earliestTime and latestTime to reflect the time chosen by the user. The form's input supports a token that can be used for that reference.

Example:

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>0</earliestTime>
        <latestTime>-2d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <searchString>index=* | head 100</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
      </event>
    </panel>
  </row>
</form>
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

[Puzzles] Solve, Learn, Repeat: Nested loops in Event Conversion

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...