Splunk Search

One TimeRangePicker for all charts - modules

Ant1D
Motivator

Hey,

The answer to this question will be very useful to know 🙂

I have an advanced dashboard with a few charts (1 column, 2 pie) and each chart contains its own distinct timerangepicker to run its own saved search for a chosen time period. I want to put more charts onto this dashboard and each addition will also have its own timerangepicker. However, it would be easier and more practical to have one timerangepicker that when a time period is chosen (say last 7 days), every chart on this dash board will execute the search it owns to produce results for the last 7 days. This would be better than having to change several timerangepickers.

Here is the code I currently have for my dashboard:

view template="dashboard.html">

<label>Errors by time</label>

<module name="AccountBar" layoutPanel="navigationHeader"/>

<module name="AppBar" layoutPanel="navigationHeader"/>

<module name="Message" layoutPanel="messaging">

<param name="filter">*</param>

<param name="clearOnJobDispatch">False</param>

<param name="maxSize">1</param>

</module>

<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Errors by category over a given time" autoRun="True">

<param name="savedSearch">20.1 Errors by category</param>

 <module name="TimeRangePicker">

         <param name="searchWhenChanged">True</param>

         <param name="default">Last 24 hours</param>

          <module name="HiddenChartFormatter">

                 <param name="charting.chart">column</param>

                 <param name="chart.stackMode">stacked</param>

                 <param name="secondaryAxisTitle.text">count</param>

                 <module name="JobProgressIndicator"></module>

                    <module name="FlashChart">

                           <param name="width">100%</param>

                           <param name="height">400px</param>

                    </module>

          </module>



          <module name="ViewRedirectorLink">

                 <param name="viewTarget">flashtimeline</param>

                 <param name="popup">True</param>      

          </module> 




 </module>

</module>

<module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" group="Errors by name over a given time" autoRun="True">

<param name="savedSearch">20.2 Errors by name</param>

 <module name="TimeRangePicker">

         <param name="searchWhenChanged">True</param>

         <param name="default">Last 24 hours</param>

          <module name="HiddenChartFormatter">

                 <param name="charting.chart">pie</param>

                 <module name="JobProgressIndicator"></module>

                    <module name="FlashChart">

                           <param name="width">100%</param>

                           <param name="height">400px</param>

                    </module>

          </module>



          <module name="ViewRedirectorLink">

                 <param name="viewTarget">flashtimeline</param>

                 <param name="popup">True</param>      

          </module> 




 </module>

</module>

<module name="HiddenSavedSearch" layoutPanel="panel_row2_col2" group="Errors by type" autoRun="True">

<param name="savedSearch">20.3 Errors by severity</param>

 <module name="TimeRangePicker">

         <param name="searchWhenChanged">True</param>

         <param name="default">Last 24 hours</param>

          <module name="HiddenChartFormatter">

                 <param name="charting.chart">pie</param>

                 <module name="JobProgressIndicator"></module>

                    <module name="FlashChart">

                           <param name="width">100%</param>

                           <param name="height">400px</param>

                    </module>

          </module>



          <module name="ViewRedirectorLink">

                 <param name="viewTarget">flashtimeline</param>

                 <param name="popup">True</param>      

          </module> 




 </module>

</module> </view>

I just want to know how I can make the 3 timerangepicker modules that I have here become just 1 timerangepicker that controls all charts.

Thanks in advance for your help

1 Solution

Brian_Osburn
Builder

It's done easy enough - move the time range picker module up to the top and have everything else be a child of it.

<view template="dashboard.html">
  <label>Errors by time</label>
  <module name="AccountBar" layoutPanel="navigationHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="TimeRangePicker" layoutPanel="panel_row1_col1">
    <param name="searchWhenChanged">True</param>
    <param name="default">Last 24 hours</param>
      <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" group="Errors by category over a given time" autoRun="True">
        <param name="savedSearch">20.1 Errors by category</param>
        <module name="HiddenChartFormatter">
          <param name="charting.chart">column</param>
          <param name="chart.stackMode">stacked</param>
          <param name="secondaryAxisTitle.text">count</param>
          <module name="JobProgressIndicator"></module>
            <module name="FlashChart">
              <param name="width">100%</param>
              <param name="height">400px</param>
            </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
            <param name="popup">True</param>      
          </module> 
      </module>
      <module name="HiddenSavedSearch" layoutPanel="panel_row3_col1" group="Errors by name over a given time" autoRun="True">
        <param name="savedSearch">20.2 Errors by name</param>
        <module name="HiddenChartFormatter">
          <param name="charting.chart">pie</param>
          <module name="JobProgressIndicator">
            <module name="FlashChart">
              <param name="width">100%</param>
              <param name="height">400px</param>
             </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
            <param name="popup">True</param>      
          </module> 
        </module>
     </module>
     <module name="HiddenSavedSearch" layoutPanel="panel_row4_col2" group="Farm errors by book" autoRun="True">
       <param name="savedSearch">20.3 Errors by severity</param>
       <module name="HiddenChartFormatter">
         <param name="charting.chart">pie</param>
         <module name="JobProgressIndicator"></module>
           <module name="FlashChart">
             <param name="width">100%</param>
             <param name="height">400px</param>
           </module>
         </module>
       <module name="ViewRedirectorLink">
         <param name="viewTarget">flashtimeline</param>
         <param name="popup">True</param>      
       </module> 
    </module>
  </module> 
</view>

View solution in original post

Brian_Osburn
Builder

It's done easy enough - move the time range picker module up to the top and have everything else be a child of it.

<view template="dashboard.html">
  <label>Errors by time</label>
  <module name="AccountBar" layoutPanel="navigationHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="TimeRangePicker" layoutPanel="panel_row1_col1">
    <param name="searchWhenChanged">True</param>
    <param name="default">Last 24 hours</param>
      <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" group="Errors by category over a given time" autoRun="True">
        <param name="savedSearch">20.1 Errors by category</param>
        <module name="HiddenChartFormatter">
          <param name="charting.chart">column</param>
          <param name="chart.stackMode">stacked</param>
          <param name="secondaryAxisTitle.text">count</param>
          <module name="JobProgressIndicator"></module>
            <module name="FlashChart">
              <param name="width">100%</param>
              <param name="height">400px</param>
            </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
            <param name="popup">True</param>      
          </module> 
      </module>
      <module name="HiddenSavedSearch" layoutPanel="panel_row3_col1" group="Errors by name over a given time" autoRun="True">
        <param name="savedSearch">20.2 Errors by name</param>
        <module name="HiddenChartFormatter">
          <param name="charting.chart">pie</param>
          <module name="JobProgressIndicator">
            <module name="FlashChart">
              <param name="width">100%</param>
              <param name="height">400px</param>
             </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
            <param name="popup">True</param>      
          </module> 
        </module>
     </module>
     <module name="HiddenSavedSearch" layoutPanel="panel_row4_col2" group="Farm errors by book" autoRun="True">
       <param name="savedSearch">20.3 Errors by severity</param>
       <module name="HiddenChartFormatter">
         <param name="charting.chart">pie</param>
         <module name="JobProgressIndicator"></module>
           <module name="FlashChart">
             <param name="width">100%</param>
             <param name="height">400px</param>
           </module>
         </module>
       <module name="ViewRedirectorLink">
         <param name="viewTarget">flashtimeline</param>
         <param name="popup">True</param>      
       </module> 
    </module>
  </module> 
</view>

Ant1D
Motivator

Thanks for the update Brian. It works. I did everything you did but forgot to specify a layoutPanel attribute for the TimeRangePicker

0 Karma

Brian_Osburn
Builder

Updated the xml to include the whole thing.. Another good resource is the UI examples application which cover this specific topic..

Ant1D
Motivator

this does not work. I tried it and my dashboard disappeared from my navigation menu

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...