Dashboards & Visualizations

searchPostProcess downstream panels not reloading after token input change

the_wolverine
Champion

I have a form that uses a searchTemplate and postProcess. The form is so that the user can select the time range for the base query. When I change the time range using the drop down, my postProcess panels are not being updated. What am I don't wrong?

<form>
  <label>Sample Dashboard</label>
  <description>USES POSTPROCESS</description>
    <fieldset submitButton="true" autoRun="false">
    <input type="time" token="earliest" searchWhenChanged="true">
      <label>Select Timerange</label>
      <default>
        <earliest>-1h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <searchTemplate>index=summary search_name="Summary Test" | stats sum(total) as total sum(bytes) as bytes by city,state</searchTemplate> 
          <earliest>$earliest.earliest$</earliest>
          <latest>$earliest.latest$</latest>
  <row>
    <panel>
      <table>
        <title>bytes by city,state</title>
        <searchPostProcess>search state=CA  | stats sum(bytes) as bytes by city </searchPostProcess>
          <earliest>$earliest.earliest$</earliest>
          <latest>$earliest.latest$</latest>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
</row>
</form>
0 Karma

renjith_nair
Legend

Which versin of splunk you are using ?

I think you should use

               <earliestTime>$earliest.earliest$</earliestTime>
               <latestTime>$earliest.latest$</latestTime>

Instead of earliest and latest

Below works fine for me

     <form>
       <label>Sample Dashboard</label>
       <description>USES POSTPROCESS</description>
         <fieldset submitButton="false" autoRun="false">
         <input type="time" token="earliest" searchWhenChanged="true">
           <label>Select Timerange</label>
           <default>Last 24 hours</default>
         </input>
       </fieldset>
       <searchTemplate>index=_internal | stats count by sourcetype</searchTemplate> 
               <earliestTime>$earliest.earliest$</earliestTime>
               <latestTime>$earliest.latest$</latestTime>
       <row>
         <panel>
           <table>
             <title>bytes by city,state</title>
             <searchPostProcess>search sourcetype="splunkd"  | stats sum(count) </searchPostProcess>
               <earliestTime>$earliest.earliest$</earliestTime>
               <latestTime>$earliest.latest$</latestTime>
             <option name="wrap">true</option>
             <option name="rowNumbers">false</option>
             <option name="dataOverlayMode">none</option>
             <option name="drilldown">cell</option>
             <option name="count">10</option>
           </table>
         </panel>
     </row>
     </form>
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

renjith_nair
Legend

Does it work for you?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...