Dashboards & Visualizations

Using time token to restrict results in dropdown

Path Finder

I have two dropdown inputs. First drop down is to select time . 2nd drop down is populated using another search but needs to be limited by time range selected in 1st drop down. Below is the form I wrote. I tried using with time token from previous dropdown but it doesn't help in limiting the search. I know that appending search with earliest= and latest= will restrict the results but then I am not able to use the $time$ token.

Is there any way to restrict the search results for 2nd dropdown based on a dynamic time range ?

  <label>Adhoc Query</label>
  <fieldset autoRun="false" submitButton="true">
    <input type="dropdown" token="time" searchWhenChanged="true">
      <label>Select a Time Range:</label>
      <choice value="-30m@m">Last half hour</choice>
      <choice value="-60m@m">Last 1 hour</choice>
      <choice value="-240m@m">Last 4 hours</choice>
      <choice value="-24h">Last 24 hours</choice>
      <choice value="-48h">Last 2 days</choice>
      <choice value="-10d@d">Last 10 days</choice>
    <input type="dropdown" token="operationname" searchWhenChanged="true">
      <label>Select an Operation:</label>
      <choice value="*">All</choice>
      <populatingSearch fieldForValue="OpNm" fieldForLabel="OpNm">
        <![CDATA[ sourcetype="abclogskv" | stats count by OpNm]]>
0 Karma

Path Finder

Hi! acharlieh,

I had tried that with rich xml editor and it was complaining about invalid XML . This time I changed to plain text and used the same token it worked. I am not sure why though.

Thanks for prompting me to try it out again.


0 Karma


Hi Shailesh. Just so you know, I also have issues with the rich XML editor in both IE and Chrome. I now always use a separate editor.

0 Karma

Path Finder

Thanks lenny.. I will also be avoiding rich XML editor

0 Karma


Why are you not able to use the $time$ token inline?

<populatingSearch fieldForValue="OpNm" fieldForLabel="OpNm">
   <![CDATA[ sourcetype="abclogskv" earliest="$time$" latest=now | stats count by OpNm]]>
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...