- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all
Found that Splunk do not let you schedule PDFs if you have forms on your dashboard. (even though it has default settings).
I then have to manually update the time interval for every search in the dashboard.
aka add the following to every search
<earliest>-1d@d</earliest>
<latest>@d</latest>
I like it to be a token aka $myearliest$, but how do I declare this, tried with set and eval, but they need some parent setting I was unable get to work.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
you can not use only $myearliest$ token just add ".earliest''
<input type="time" token="myearliest">
<label></label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</input>
<search>
<query>enter you search code here</query>
<earliest>$myearliest.earliest$</earliest>
<latest>$myearliest.latest$</latest>
</search>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi gyslainlatsa
Thanks for your answer.
I tried adding the input settings to the top and into the row with the search itself.
but my dashboard only says "search is waiting for input"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
if your dashboad displays "search is waiting for input", check if all the tokens have default values that were indicated in your xml code.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
you can not use only $myearliest$ token just add ".earliest''
<input type="time" token="myearliest">
<label></label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</input>
<search>
<query>enter you search code here</query>
<earliest>$myearliest.earliest$</earliest>
<latest>$myearliest.latest$</latest>
</search>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Had to add to the first panel, and there is shows like a time form component, but it is obviously global so it works on all the other searches in the dashboard also. And I can schedule automatic PDF based on the delivery.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi,
try like this:
<input type="time" token="field1">
<label></label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
<search>
<query>index=* OR index=_* |stats count by source</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks this is correct, turns out the PDF scheduler checks on