simple xml - setting global not form variables

[mortenb123]

Hi all

Found that Splunk do not let you schedule PDFs if you have forms on your dashboard. (even though it has default settings).

I then have to manually update the time interval for every search in the dashboard.
aka add the following to every search

    <earliest>-1d@d</earliest>
    <latest>@d</latest>

I like it to be a token aka $myearliest$, but how do I declare this, tried with set and eval, but they need some parent setting I was unable get to work.

Thanks

[mortenb123]

Hi gyslainlatsa

Thanks for your answer.

I tried adding the input settings to the top and into the row with the search itself.
but my dashboard only says "search is waiting for input"

[gyslainlatsa]

if your dashboad displays "search is waiting for input", check if all the tokens have default values that were indicated in your xml code.

[chimell · Accepted solution]

Hi
you can not use only $myearliest$ token just add ".earliest''

<input type="time" token="myearliest">
     <label></label>
     <default>
      <earliest>-1d@d</earliest>
     <latest>@d</latest>
     </default>
   </input>

   <search>
         <query>enter you search code here</query>
         <earliest>$myearliest.earliest$</earliest>
         <latest>$myearliest.latest$</latest>
    </search>

[mortenb123]

Had to add to the first panel, and there is shows like a time form component, but it is obviously global so it works on all the other searches in the dashboard also. And I can schedule automatic PDF based on the delivery.
Thanks

[gyslainlatsa]

hi,

try like this:

<input type="time" token="field1">
    <label></label>
    <default>
      <earliest>0</earliest>
      <latest></latest>
    </default>
  </input>

  <search>
        <query>index=* OR index=_* |stats count by source</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
   </search>

[mortenb123]

Thanks this is correct, turns out the PDF scheduler checks on