Splunk Search

Set given preset value in time range picker

fjp2485
Engager

Hi,

I'm using Splunk Enterprise 7.2.3.
I have a time range picker on my dashboard to set the date/time range to search between. I want to set its default value to "Previous week". In the XML code of the dashboard I can calculate the required date range and I can set that in the time range picker also (and it works well), but the displayed preset value will be: "Between Date-times". But I want to show: "Previous week". How can I do it?

Thanks in advance,
fjp2485

0 Karma

fjp2485
Engager

I've found a solution: the default value of the dat/time picker has to be Previous week. See the code below. In addition in its change section it contains code which converts the earliest and latest values to human readable form (earliest_str and latest_str).

    <input type="time" token="range" searchWhenChanged="true">
      <label>Set Date/Time Range</label>
      <default>Previous week</default>
      <change>
        <eval token="earliest_tok">if(isnum($range.earliest$), $range.earliest$, relative_time(now(), $range.earliest$))</eval>
        <eval token="latest_tok">if(isnull($range.latest$), now(), if(isnum($range.latest$), $range.latest$, relative_time(now(), $range.latest$)))</eval>
        <eval token="earliest_str">strftime($earliest_tok$, "%Y.%m.%d")</eval>
        <eval token="latest_str">strftime($latest_tok$ - 1, "%Y.%m.%d")</eval>
      </change>
    </input>

In order to have right earliest_str and latest_str just after opening the dashboard we have to initialize them in the init section of the dashboard:

  <init>
    <eval token="earliest_tok">relative_time(now(), "-7d@w0")</eval>
    <eval token="latest_tok">relative_time(now(), "@w0")</eval>
    <eval token="earliest_str">strftime($earliest_tok$, "%Y.%m.%d")</eval>
    <eval token="latest_str">strftime($latest_tok$ - 1, "%Y.%m.%d")</eval>
  </init>

In this init section the relative date format is to be used: "-7d@w0" and "@w0" which is equivalent to Previous week default value of the date/time picker input control.

0 Karma

somesoni2
Revered Legend

In your dashboard xml, update the stanza for time input to use following relative time range:
Updated

<earliest>-7d@w0</earliest>
<latest>@w0</latest>
0 Karma

fjp2485
Engager

Hi somesoni2,

Thanks for your answer.
You probably meant -1w@w0 instead of -7w, isn't it?

So the complete input section supposed to look like this:

    <input type="time" token="range" searchWhenChanged="true">
      <label>Set Date/Time Range</label>
      <default>
        <earliest>-1w@w0</earliest>
        <latest>@w0</latest>
      </default>
    </input>

Unfortunately the displayed text is "Custom time", see screenshot below:
alt text

But my specification prescribes to show: "Previous week" because this text is more informative for the user.

0 Karma

somesoni2
Revered Legend

That was a typo on my side. I wanted to use -7d@w0. Also, I'm assuming you're launching the dashboard fresh (from navigation menu) after making change so that it's using the default values of the time range picker.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!