Splunk Search

Is there an option to add Time Token function on Dashboard?

cbiraris
Path Finder

Hi Team,

I have  several Dashboards that contain base searches data from reports  for example: 

<search id="baseSearch" ref="Report"></search> 

but, I see that I am not getting option to add time token on dashboard.

Is there any option we can provide the time token to expand or reduced time window for end users on dashboard by using ref="Report" saved search method ? 


0 Karma
1 Solution

FelixLeh
Contributor

Reports are snapshots of data and can't be changed after they are created. Thus you aren't able to change the time on a report once it is done. You could create multiple reports with the same search but different time ranges but I don't think that is what you want.

You could create the report over the maximum duration that you want users to see and use a time picker to limit the events shown.

Make a separate panel in the dashboard that uses the report as its base and insert the following code:

| where _time>relative_time(now(),"$time_token.earliest$")

Dashboard example: 

<form version="1.0">
<search id="base" ref="test_report"></search>
<label>Test</label>
<fieldset submitButton="false">
<input type="time" token="time_token">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>This is my Panel</title>
<table>
<search base="base">
<query>| where _time&gt;relative_time(now(),"$time_token.earliest$")</query>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>

 

_______________________________________

If this was helpful please consider awarding Karma. Thx!

 

View solution in original post

cbiraris
Path Finder

This is awesome. Thank you for sharing this is working @FelixLeh 

0 Karma

FelixLeh
Contributor

Glad to hear that! You're Welcome! 😄

(You could mark my answer as the solution to complete/close the question 😉 )

0 Karma

FelixLeh
Contributor

Reports are snapshots of data and can't be changed after they are created. Thus you aren't able to change the time on a report once it is done. You could create multiple reports with the same search but different time ranges but I don't think that is what you want.

You could create the report over the maximum duration that you want users to see and use a time picker to limit the events shown.

Make a separate panel in the dashboard that uses the report as its base and insert the following code:

| where _time>relative_time(now(),"$time_token.earliest$")

Dashboard example: 

<form version="1.0">
<search id="base" ref="test_report"></search>
<label>Test</label>
<fieldset submitButton="false">
<input type="time" token="time_token">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>This is my Panel</title>
<table>
<search base="base">
<query>| where _time&gt;relative_time(now(),"$time_token.earliest$")</query>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>

 

_______________________________________

If this was helpful please consider awarding Karma. Thx!

 
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...