I have a form that uses a searchTemplate and postProcess. The form is so that the user can select the time range for the base query. When I change the time range using the drop down, my postProcess panels are not being updated. What am I don't wrong?
<form>
<label>Sample Dashboard</label>
<description>USES POSTPROCESS</description>
<fieldset submitButton="true" autoRun="false">
<input type="time" token="earliest" searchWhenChanged="true">
<label>Select Timerange</label>
<default>
<earliest>-1h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<searchTemplate>index=summary search_name="Summary Test" | stats sum(total) as total sum(bytes) as bytes by city,state</searchTemplate>
<earliest>$earliest.earliest$</earliest>
<latest>$earliest.latest$</latest>
<row>
<panel>
<table>
<title>bytes by city,state</title>
<searchPostProcess>search state=CA | stats sum(bytes) as bytes by city </searchPostProcess>
<earliest>$earliest.earliest$</earliest>
<latest>$earliest.latest$</latest>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
</form>
Which versin of splunk you are using ?
I think you should use
<earliestTime>$earliest.earliest$</earliestTime>
<latestTime>$earliest.latest$</latestTime>
Instead of earliest
and latest
Below works fine for me
<form>
<label>Sample Dashboard</label>
<description>USES POSTPROCESS</description>
<fieldset submitButton="false" autoRun="false">
<input type="time" token="earliest" searchWhenChanged="true">
<label>Select Timerange</label>
<default>Last 24 hours</default>
</input>
</fieldset>
<searchTemplate>index=_internal | stats count by sourcetype</searchTemplate>
<earliestTime>$earliest.earliest$</earliestTime>
<latestTime>$earliest.latest$</latestTime>
<row>
<panel>
<table>
<title>bytes by city,state</title>
<searchPostProcess>search sourcetype="splunkd" | stats sum(count) </searchPostProcess>
<earliestTime>$earliest.earliest$</earliestTime>
<latestTime>$earliest.latest$</latestTime>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
</form>
Does it work for you?