Splunk Enterprise

time picker

anissabnk
Path Finder

Hello,

I have a question about customising my time picker.
I'd like to display two panels, one for 24 hours and one for 1 month.
And I'd like panel 1 to be displayed when the teps selected is 24h, and the second panel to be displayed when the time picker is for the current month.

 

I tried this, but it doesn't work :

<form version="1.1" theme="light">
<label>dev_vwt_dashboards_uc47</label>
<init>
<set token="time_range">-24h@h</set>
<set token="date_connection">*</set>
<set token="time_connection">*</set>
<set token="IPAddress">*</set>
<set token="User">*</set>
<set token="AccessValidation">*</set>
</init>
<!--fieldset autoRun="false" submitButton="true">
<input type="time" token="field1" searchWhenChanged="true">
<label>Period</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset-->
<fieldset autoRun="false" submitButton="true">
<input type="dropdown" token="time_range" searchWhenChanged="true">
<label>Select Time Range</label>
<choice value="-24h@h">Last 24 hours</choice>
<!--choice value="@mon">Since Beginning of Month</choice-->
<default>Last 24 hours</default>
<!--change>
<condition value="-24h@h">
<set token="tokShowPanel1">true</set>
<unset token="tokShowPanel2"></unset>
</condition>
<condition value="@mon">
<unset token="tokShowPanel1"></unset>
<set token="tokShowPanel2">true</set>
</condition>
</change-->
</input>
</fieldset>
<row>
<panel>
<input type="text" token="date_connection" searchWhenChanged="true">
<label>date_connection</label>
<default>*</default>
<prefix>date_connection="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<input type="text" token="time_connection" searchWhenChanged="true">
<label>time_connection</label>
<default>*</default>
<prefix>time_connection="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<input type="text" token="IPAddress" searchWhenChanged="true">
<label>IPAddress</label>
<default>*</default>
<prefix>IPAddress="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<input type="text" token="User" searchWhenChanged="true">
<label>User</label>
<default>*</default>
<prefix>User="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="AccessValidation" searchWhenChanged="true">
<label>AccessValidation</label>
<default>*</default>
<prefix>AccessValidation="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
<choice value="*">All</choice>
<choice value="failure">failure</choice>
<choice value="success">success</choice>
<choice value="denied">denied</choice>
</input>
</panel>
</row>
<row>
<panel id="AD_Users_Authentication_last_24_hours" depends="$tokShowPanel1$">
<title>AD Users Authentication</title>
<table>
<search>
<query>|loadjob savedsearch="anissa.bannak.ext@abc.com:search:dev_vwt_saved_search_uc47_AD_Authentication_Result" |rename UserAccountName as "User" |search $date_connection$ $time_connection$ $IPAddress$ $User$ $AccessValidation$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">100</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="Last Connection Status">
<colorPalette type="map">{"failure":#D94E17,"success":#55C169}</colorPalette>
</format>
<format type="color" field="Access Validation">
<colorPalette type="map">{"success":#55C169,"failure":#D94E17}</colorPalette>
</format>
<format type="number" field="AuthenticationResult"></format>
<format type="color" field="AuthenticationResult">
<colorPalette type="map">{"failure":#D94E17,"success":#55C169}</colorPalette>
</format>
<format type="color" field="Access_Validation">
<colorPalette type="map">{"success":#55C169,"failure":#D41F1F}</colorPalette>
</format>
<format type="color" field="AccessValidation">
<colorPalette type="map">{"success":#118832,"failure":#D41F1F}</colorPalette>
</format>
<format type="color" field="last_connection_status">
<colorPalette type="map">{"success":#55C169,"failure":#D94E17}</colorPalette>
</format>
</table>
</panel>
</row>
<row>
<panel id="AD_Users_Authentication_1_month" depends="$tokShowPanel2$">
<title>AD Users Authentication</title>
<table>
<search>
<query>|loadjob savedsearch="anissa.bannak.ext@abc.com:search:dev_vwt_saved_search_uc47_AD_Authentication_Result" |rename UserAccountName as "User" |search $date_connection$ $time_connection$ $IPAddress$ $User$ $AccessValidation$</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
<option name="count">100</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="Last Connection Status">
<colorPalette type="map">{"failure":#D94E17,"success":#55C169}</colorPalette>
</format>
<format type="color" field="Access Validation">
<colorPalette type="map">{"success":#55C169,"failure":#D94E17}</colorPalette>
</format>
<format type="number" field="AuthenticationResult"></format>
<format type="color" field="AuthenticationResult">
<colorPalette type="map">{"failure":#D94E17,"success":#55C169}</colorPalette>
</format>
<format type="color" field="Access_Validation">
<colorPalette type="map">{"success":#55C169,"failure":#D41F1F}</colorPalette>
</format>
<format type="color" field="AccessValidation">
<colorPalette type="map">{"success":#118832,"failure":#D41F1F}</colorPalette>
</format>
<format type="color" field="last_connection_status">
<colorPalette type="map">{"success":#55C169,"failure":#D94E17}</colorPalette>
</format>
</table>
</panel>
</row>
</form>
Labels (1)
0 Karma

marnall
Motivator

Does the time range picker need to be a time range picker? You could set it up as a dropdown with 2 options: 24h and 1month, then make 2 panels in your dashboard which each depend on a token to be set when the dropdown option is selected. Then set the panels to have searches whose <earliest> time is -24h and -1mon respectively. Only one panel will display at a time.

 

<form version="1.1" theme="dark">
  <label>2 Time Picker Dashboard</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>timerange</label>
      <choice value="1">24h</choice>
      <choice value="2">1month</choice>
      <change>
        <eval token="dp1">if($value$="1",true(),null())</eval>
        <eval token="dp2">if($value$="2",true(),null())</eval>
      </change>
      <default>1</default>
      <initialValue>1</initialValue>
    </input>
  </fieldset>
  <row depends="$dp1$">
    <panel>
      <table>
        <search>
          <query>search index=* | head 5</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row depends="$dp2$">
    <panel>
      <table>
        <search>
          <query>search index=* | head 10</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...