Can timechart zoom alter time range picker?

[JCracknell]

Is there anyway to set up a timechart so that, when you drag across it to zoom in on specific details, the time range picker changes to what you're zoomed into?

For example if you had a dashboard with a timechart and a table both configured to the same time range picker and you zoom in on a certain detail in the timechart, is there a way that the table will update to show only the events that are zoomed in on?

[martin_mueller · Accepted solution]

You can have the pan&zoom selection in a chart set the timerange for a search in your dashboard, yeah.

Grab the Splunk 6 Dashboard Examples app from http://apps.splunk.com/app/1603/ and open the Pan and Zoom Chart Controls example. On its right hand side you see an example where the upper chart's selected range sets the timerange for the bottom chart. Adapt that to your dashboard/table and you're there.

[martin_mueller]

Do open a new question. The only reason I looked at this was your downvote, you can't rely on someone still being subscribed to an answer he posted years ago. Similarly, the person asking this question may not be active any more, so there's nobody to help you in this thread.

A new question will get its due attention. While there may be overlap, some overlap is okay - and some apparent overlap may be due to differences in Splunk version. Some things requiring code in an earlier version may now have a built-in solution today, for example.
In a new question, you get the chance to direct the discussion the way you like by posting and responding to comments for clarification.
In a new question, you get the chance to mark an answer as accepted.

[martin_mueller]

If you expect zero-day responses to two-year-old issues from a volunteer community, you're gonna have a bad time... regardless of Kibana or Splunk.

If you read the question carefully, you'll spot "For example if you had a dashboard with a timechart and a table both configured to the same time range picker and you zoom in on a certain detail in the timechart, is there a way that the table will update to show only the events that are zoomed in on?"
My answer addresses exactly that, the table will update. If you have a different question, feel free to open a new question.

[Graham_Hanningt]

I apologize. I had no such expectation, but I can see how it might look to you.

I showed someone at work some comments I had added to existing questions on Splunk Answers, and they asked me why I did not upvote or "me too" the questions. I decided they had a point. That prompted me to return to this question, that I had recently commented on, and downvote it for the reason I gave. In hindsight, I should have performed a single action - a downvote with a comment - rather than commenting, and then downvoting almost immediately after. I appended that "(Before downvoting...)" explanation because I wasn't sure how or where my reason for downvoting would appear (I now realize it appears in the comments thread).

Again, I apologize for my poor etiquette.

I did read the question carefully, and I did spot that "For example..." in the details of the question. But my reason for downvoting your answer remains.

My answer addresses exactly that, the table will update.

Yes, I agree, it does.

If you have a different question, feel free to open a new question.

My question is "Can timechart zoom alter time range picker?"; the same as this question: that is, the single line that Splunk Answers characterizes as the question ("Type your question here...") as opposed to the multi-line details ("Fill in the details...").

I'm unsure how to proceed. Opening a new "Can timechart zoom alter time range picker?" question feels wrong to me, and asking the same question using different words also feels wrong.

I'd be grateful for your thoughts.

[ppablo]

Hi @Graham_Hannington

@martin_mueller is actually one of the most helpful and brightest users in the Splunk community. He's one of our SplunkTrust members that has been educating and assisting users for years through this forum, chat, and various Splunk and industry events. Everyone here is volunteering to help out other users by sharing their knowledge through years of experience deploying, managing, and using Splunk products. Please don't be so quick to downvote other users in this forum unless they've given you a blatantly wrong or possibly dangerous solution that could break something in your environment.

I'm glad to see you're starting to become more active on the site since you joined late last year, but please be sure to check out the major points in this previous post on how etiquette works in this forum. You'll establish strong(er) networks with the right people much faster if you take a more positive approach in how you engage with other folks on Splunk Answers and other community spaces.
https://answers.splunk.com/answers/244111/proper-etiquette-and-timing-for-voting-here-on-ans.html

Cheers

Patrick

[Graham_Hanningt]

Hi @ppablo

I viewed Martin's profile before downvoting. I knew I was downvoting an answer from someone with a lot of karma points.

However, I hadn't seen that proper etiquette link before; thanks for that. I see people expressing differing opinions there, but the consensus seems to be, as you say, to reserve downvoting for the cases you cite. I will follow that practice in future.

I agree unequivocally with the following comment on that page:

one thing i'd like to say in particular is that i want to emphasize that downvotes should never given, nor taken, personally

At the time, it did not occur to me that downvoting this answer might be interpreted as "taking a negative approach in how I engage with other folks", but after reading the comments on that proper etiquette page, and based on the reaction from you and Martin, I can see that I was both naive and ignorant. Again, I apologize. I sincerely did not mean to offend.

[ppablo]

No problem @Graham_Hannington Thanks for understanding and being open to learning more about Splunk community culture. We all just want to make sure users maximize getting the help they need 🙂

Cheers and good luck!

Patrick

[Graham_Hanningt]

I downvoted this answer because it does not address the specific question: can timechart zoom alter time range picker? The answer does not specifically refer to altering the time range picker. (Before downvoting, I requested clarification on this issue.)

[Graham_Hanningt]

I have the same specific question: can timechart zoom alter time range picker?

Unfortunately, I don't understand how this answer applies to that specific question.

I've installed the latest version (5.0.1) of the Splunk 6.x Dashboard Examples app in Splunk Enterprise 6.4.

Yes, I can see in the example dashboard how zooming a timechart sets tokens with the values of the zoom selection start and end times, and how another chart refers to those tokens to set its time range. But none of this involves a time range picker.

I have dashboards with a time picker and multiple timecharts. I want timechart zoom to alter the time range picker. That is, when I zoom any timechart, I want the time picker to reflect the zoom selection range, and for all of the charts in the dashboard (that use the time picker to set their time range) to update to match that time range, just as if I had used the time picker to set that time range.

I fear I'm missing something in "Adapt that to your dashboard", but what?

[Graham_Hanningt]

I fear that I am going to have to write JavaScript to call the set method of the settings property of the time range picker (TimeRangeView), to set the time range picker to the zoomed time range. But I've only just started to scratch the surface of the Splunk Web Framework, so there might be a better way. And I'm frankly in a state of disbelief that I might have to go to that effort - write code - to achieve this syncing.

I've recently been working in Kibana (Elastic Stack), which offers this behavior out of the box: zooming (marquee selecting a time range) in any time-based chart sets the time range across the entire dashboard.

I'd be happy to learn that the preconceptions that I have brought with me from Kibana have led me astray when learning Splunk. However, this use case - syncing the time range across a dashboard after zooming in one chart -
seems to me to be as applicable to Splunk as it is to any other analytics platform.

Am I missing some obvious Splunk-y way to achieve this?