Assigning a field to be used by the timepicker

[shipitsquirrel]

Hello all, 

While developing my Splunk Add-On, I've run into a blocker concerning the timepicker on search. Currently, changing the time from the default "Last 24 Hours" to any other value has no effect and the search always returns all of the elements from my KV store. I've read through about a dozen forum threads but haven't found a clear answer to this problem. 

Any help with what settings/files need to be configured would be appreciated!

I am developing in Splunk Enterprise 9.1.3

[bowesmana]

What's your search that's returning the data - is this in a dashboard. If the data is coming from a KV store than you will have to do the time bounding yourself as Splunk will not limit your result set based on time as there is no similar time concept in the KV store, you have to do it yourself.

[shipitsquirrel]

I'm trying to make it so any search on my KV store will be filterable by the timepicker. So if I were to search

|inputlookup {collection_name}

I would get back all the entries from my collection based on the selected time range. 

Are you saying that since it's a KV store I'll need to include time constraints in each query to make this work? 

[bowesmana]

Yes, because KV store is not a time-series DB like the Splunk index effectively is.

A KV store has no fixed _time field like there is for every event in a Splunk index - you define the fields in your collection, so you need to control what gets filtered.

If you have a field called KV_entry_time, which is stored as an epoch, then you will need to convert your time picker selection to epoch start/end values and then 

|inputlookup {collection_name} where KV_entry_time >= $time_picker_start$ AND KV_entry_time < $time_picker_end$

 There is a trick to converting the time picker input to a start/end epoch value - you need a background search in the XML like this

<search>
  <query>
| makeresults
| addinfo
  </query>
  <done>
    <set token="time_picker_start">$result.info_min_time$</set>
    <set token="time_picker_end">$result.info_max_time$</set>
  </done>
  <earliest>$time_picker.earliest$</earliest>
  <latest>$time_picker.latest$</latest>
</search>

which will use addinfo to get the time picker's epoch values from info_*_time and then the token setting will convert those to the time_picker_* tokens you can use in the collection search. 

Hope this helps