Splunk Enterprise

Help with drilldown from a timepicker between 2 dashboards

jip31
Motivator

hello

in my first dashboard, I use the timepicker below

 

 

  <fieldset submitButton="false">
    <input type="dropdown" token="period">
      <label>Période</label>
      <choice value="1654466400.0">Lundi 6 Juin 2022</choice>
      <choice value="1655071200.0">Lundi 13 Juin 2022</choice>
      <choice value="1655676000.0">Lundi 20 Juin 2022</choice>
      <change>
        <eval token="debut">period</eval>
        <eval token="fin">debut+432000</eval>
        <eval token="debut_4w">relative_time(debut,"-4w")</eval>
        <eval token="fin_4w">relative_time(debut,"-0w")</eval>
      </change>
      <default>1655071200.0</default>
      <initialValue>1655071200.0</initialValue>
    </input>

 

 

Now, I need to retrieve the time choice done in the timepicker in an second dashboard

So here is the link I use

 

 

 <a href="/app/spl_pub/bp?form.period=$form.period$" target="_blank">Cliquez ici</a>

 

 

And in the second dashboard, I added this in each panel but it doesnt works

 

 

| search period=$form.period$

 

 

 what is the problemplease?

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Do yo have a timepicker input on the second dashboard called period? If not, then you just want to pass the token as

period=$form.period$

then you can search

search period=$period$
Tags (1)
0 Karma

jip31
Motivator

I dont succeed

I have done some changes

I have added the same timepicher in the second dashboard

So I call it like this

 

<a href="/app/spl_pub/bp?form.period=$form.period$" target="_blank">Cliquez ici</a>

 

It works fine because the time choice done in the first dash is the same in the second dash

But I dont succeed to update my panel in the second dash from the time choice

when I look the url of the second dash, I can see there is an issue with periode2, periode3, periode4....

 

form.period=1656280800.0&form.periode2.earliest=-7d%40h&form.periode2.latest=now&form.periode3.earliest=-24h%

 

In each search of the second dash, I have added this but it doenst works

 

| search period=$period$

 

When I execute the search I have

| search period="1655071200.0"
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...