Splunk Search

One TimeRangePicker for all charts - modules

Ant1D
Motivator

Hey,

The answer to this question will be very useful to know 🙂

I have an advanced dashboard with a few charts (1 column, 2 pie) and each chart contains its own distinct timerangepicker to run its own saved search for a chosen time period. I want to put more charts onto this dashboard and each addition will also have its own timerangepicker. However, it would be easier and more practical to have one timerangepicker that when a time period is chosen (say last 7 days), every chart on this dash board will execute the search it owns to produce results for the last 7 days. This would be better than having to change several timerangepickers.

Here is the code I currently have for my dashboard:

view template="dashboard.html">

<label>Errors by time</label>

<module name="AccountBar" layoutPanel="navigationHeader"/>

<module name="AppBar" layoutPanel="navigationHeader"/>

<module name="Message" layoutPanel="messaging">

<param name="filter">*</param>

<param name="clearOnJobDispatch">False</param>

<param name="maxSize">1</param>

</module>

<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Errors by category over a given time" autoRun="True">

<param name="savedSearch">20.1 Errors by category</param>

 <module name="TimeRangePicker">

         <param name="searchWhenChanged">True</param>

         <param name="default">Last 24 hours</param>

          <module name="HiddenChartFormatter">

                 <param name="charting.chart">column</param>

                 <param name="chart.stackMode">stacked</param>

                 <param name="secondaryAxisTitle.text">count</param>

                 <module name="JobProgressIndicator"></module>

                    <module name="FlashChart">

                           <param name="width">100%</param>

                           <param name="height">400px</param>

                    </module>

          </module>



          <module name="ViewRedirectorLink">

                 <param name="viewTarget">flashtimeline</param>

                 <param name="popup">True</param>      

          </module> 




 </module>

</module>

<module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" group="Errors by name over a given time" autoRun="True">

<param name="savedSearch">20.2 Errors by name</param>

 <module name="TimeRangePicker">

         <param name="searchWhenChanged">True</param>

         <param name="default">Last 24 hours</param>

          <module name="HiddenChartFormatter">

                 <param name="charting.chart">pie</param>

                 <module name="JobProgressIndicator"></module>

                    <module name="FlashChart">

                           <param name="width">100%</param>

                           <param name="height">400px</param>

                    </module>

          </module>



          <module name="ViewRedirectorLink">

                 <param name="viewTarget">flashtimeline</param>

                 <param name="popup">True</param>      

          </module> 




 </module>

</module>

<module name="HiddenSavedSearch" layoutPanel="panel_row2_col2" group="Errors by type" autoRun="True">

<param name="savedSearch">20.3 Errors by severity</param>

 <module name="TimeRangePicker">

         <param name="searchWhenChanged">True</param>

         <param name="default">Last 24 hours</param>

          <module name="HiddenChartFormatter">

                 <param name="charting.chart">pie</param>

                 <module name="JobProgressIndicator"></module>

                    <module name="FlashChart">

                           <param name="width">100%</param>

                           <param name="height">400px</param>

                    </module>

          </module>



          <module name="ViewRedirectorLink">

                 <param name="viewTarget">flashtimeline</param>

                 <param name="popup">True</param>      

          </module> 




 </module>

</module> </view>

I just want to know how I can make the 3 timerangepicker modules that I have here become just 1 timerangepicker that controls all charts.

Thanks in advance for your help

1 Solution

Brian_Osburn
Builder

It's done easy enough - move the time range picker module up to the top and have everything else be a child of it.

<view template="dashboard.html">
  <label>Errors by time</label>
  <module name="AccountBar" layoutPanel="navigationHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="TimeRangePicker" layoutPanel="panel_row1_col1">
    <param name="searchWhenChanged">True</param>
    <param name="default">Last 24 hours</param>
      <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" group="Errors by category over a given time" autoRun="True">
        <param name="savedSearch">20.1 Errors by category</param>
        <module name="HiddenChartFormatter">
          <param name="charting.chart">column</param>
          <param name="chart.stackMode">stacked</param>
          <param name="secondaryAxisTitle.text">count</param>
          <module name="JobProgressIndicator"></module>
            <module name="FlashChart">
              <param name="width">100%</param>
              <param name="height">400px</param>
            </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
            <param name="popup">True</param>      
          </module> 
      </module>
      <module name="HiddenSavedSearch" layoutPanel="panel_row3_col1" group="Errors by name over a given time" autoRun="True">
        <param name="savedSearch">20.2 Errors by name</param>
        <module name="HiddenChartFormatter">
          <param name="charting.chart">pie</param>
          <module name="JobProgressIndicator">
            <module name="FlashChart">
              <param name="width">100%</param>
              <param name="height">400px</param>
             </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
            <param name="popup">True</param>      
          </module> 
        </module>
     </module>
     <module name="HiddenSavedSearch" layoutPanel="panel_row4_col2" group="Farm errors by book" autoRun="True">
       <param name="savedSearch">20.3 Errors by severity</param>
       <module name="HiddenChartFormatter">
         <param name="charting.chart">pie</param>
         <module name="JobProgressIndicator"></module>
           <module name="FlashChart">
             <param name="width">100%</param>
             <param name="height">400px</param>
           </module>
         </module>
       <module name="ViewRedirectorLink">
         <param name="viewTarget">flashtimeline</param>
         <param name="popup">True</param>      
       </module> 
    </module>
  </module> 
</view>

View solution in original post

Brian_Osburn
Builder

It's done easy enough - move the time range picker module up to the top and have everything else be a child of it.

<view template="dashboard.html">
  <label>Errors by time</label>
  <module name="AccountBar" layoutPanel="navigationHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="TimeRangePicker" layoutPanel="panel_row1_col1">
    <param name="searchWhenChanged">True</param>
    <param name="default">Last 24 hours</param>
      <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" group="Errors by category over a given time" autoRun="True">
        <param name="savedSearch">20.1 Errors by category</param>
        <module name="HiddenChartFormatter">
          <param name="charting.chart">column</param>
          <param name="chart.stackMode">stacked</param>
          <param name="secondaryAxisTitle.text">count</param>
          <module name="JobProgressIndicator"></module>
            <module name="FlashChart">
              <param name="width">100%</param>
              <param name="height">400px</param>
            </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
            <param name="popup">True</param>      
          </module> 
      </module>
      <module name="HiddenSavedSearch" layoutPanel="panel_row3_col1" group="Errors by name over a given time" autoRun="True">
        <param name="savedSearch">20.2 Errors by name</param>
        <module name="HiddenChartFormatter">
          <param name="charting.chart">pie</param>
          <module name="JobProgressIndicator">
            <module name="FlashChart">
              <param name="width">100%</param>
              <param name="height">400px</param>
             </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
            <param name="popup">True</param>      
          </module> 
        </module>
     </module>
     <module name="HiddenSavedSearch" layoutPanel="panel_row4_col2" group="Farm errors by book" autoRun="True">
       <param name="savedSearch">20.3 Errors by severity</param>
       <module name="HiddenChartFormatter">
         <param name="charting.chart">pie</param>
         <module name="JobProgressIndicator"></module>
           <module name="FlashChart">
             <param name="width">100%</param>
             <param name="height">400px</param>
           </module>
         </module>
       <module name="ViewRedirectorLink">
         <param name="viewTarget">flashtimeline</param>
         <param name="popup">True</param>      
       </module> 
    </module>
  </module> 
</view>

Ant1D
Motivator

Thanks for the update Brian. It works. I did everything you did but forgot to specify a layoutPanel attribute for the TimeRangePicker

0 Karma

Brian_Osburn
Builder

Updated the xml to include the whole thing.. Another good resource is the UI examples application which cover this specific topic..

Ant1D
Motivator

this does not work. I tried it and my dashboard disappeared from my navigation menu

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...