Splunk Enterprise

Help with drilldown from a timepicker between 2 dashboards

jip31
Motivator

hello

in my first dashboard, I use the timepicker below

 

 

  <fieldset submitButton="false">
    <input type="dropdown" token="period">
      <label>Période</label>
      <choice value="1654466400.0">Lundi 6 Juin 2022</choice>
      <choice value="1655071200.0">Lundi 13 Juin 2022</choice>
      <choice value="1655676000.0">Lundi 20 Juin 2022</choice>
      <change>
        <eval token="debut">period</eval>
        <eval token="fin">debut+432000</eval>
        <eval token="debut_4w">relative_time(debut,"-4w")</eval>
        <eval token="fin_4w">relative_time(debut,"-0w")</eval>
      </change>
      <default>1655071200.0</default>
      <initialValue>1655071200.0</initialValue>
    </input>

 

 

Now, I need to retrieve the time choice done in the timepicker in an second dashboard

So here is the link I use

 

 

 <a href="/app/spl_pub/bp?form.period=$form.period$" target="_blank">Cliquez ici</a>

 

 

And in the second dashboard, I added this in each panel but it doesnt works

 

 

| search period=$form.period$

 

 

 what is the problemplease?

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Do yo have a timepicker input on the second dashboard called period? If not, then you just want to pass the token as

period=$form.period$

then you can search

search period=$period$
Tags (1)
0 Karma

jip31
Motivator

I dont succeed

I have done some changes

I have added the same timepicher in the second dashboard

So I call it like this

 

<a href="/app/spl_pub/bp?form.period=$form.period$" target="_blank">Cliquez ici</a>

 

It works fine because the time choice done in the first dash is the same in the second dash

But I dont succeed to update my panel in the second dash from the time choice

when I look the url of the second dash, I can see there is an issue with periode2, periode3, periode4....

 

form.period=1656280800.0&form.periode2.earliest=-7d%40h&form.periode2.latest=now&form.periode3.earliest=-24h%

 

In each search of the second dash, I have added this but it doenst works

 

| search period=$period$

 

When I execute the search I have

| search period="1655071200.0"
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...