Getting Data In

How to use time input in another input search

matansocher
Contributor

Hi

I have a dashboard with 2 input - time and another field ('fieldA').
'fieldA' is populated by a search, and it has his own time.
How do I use the time input to the search that populates 'fieldA'?

thanks

1 Solution

tiagofbmm
Influencer

If you have a TimePicker input, you can use its token and pass it to your other input search. Check my example below:

<form>
  <label>Time</label>
  <fieldset submitButton="false">
    <input type="time" token="timepicker">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="src">
      <label>Sources</label>
      <fieldForLabel>source</fieldForLabel>
      <fieldForValue>source</fieldForValue>
      <search>
        <query>| tstats count where index=_internal by source</query>
        <earliest>$timepicker.earliest$</earliest>
        <latest>$timepicker.latest$</latest>
      </search>
    </input>
  </fieldset>
</form>

View solution in original post

tiagofbmm
Influencer

If you have a TimePicker input, you can use its token and pass it to your other input search. Check my example below:

<form>
  <label>Time</label>
  <fieldset submitButton="false">
    <input type="time" token="timepicker">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="src">
      <label>Sources</label>
      <fieldForLabel>source</fieldForLabel>
      <fieldForValue>source</fieldForValue>
      <search>
        <query>| tstats count where index=_internal by source</query>
        <earliest>$timepicker.earliest$</earliest>
        <latest>$timepicker.latest$</latest>
      </search>
    </input>
  </fieldset>
</form>
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...