Splunk Search

Set given preset value in time range picker

fjp2485
Engager

Hi,

I'm using Splunk Enterprise 7.2.3.
I have a time range picker on my dashboard to set the date/time range to search between. I want to set its default value to "Previous week". In the XML code of the dashboard I can calculate the required date range and I can set that in the time range picker also (and it works well), but the displayed preset value will be: "Between Date-times". But I want to show: "Previous week". How can I do it?

Thanks in advance,
fjp2485

0 Karma

fjp2485
Engager

I've found a solution: the default value of the dat/time picker has to be Previous week. See the code below. In addition in its change section it contains code which converts the earliest and latest values to human readable form (earliest_str and latest_str).

    <input type="time" token="range" searchWhenChanged="true">
      <label>Set Date/Time Range</label>
      <default>Previous week</default>
      <change>
        <eval token="earliest_tok">if(isnum($range.earliest$), $range.earliest$, relative_time(now(), $range.earliest$))</eval>
        <eval token="latest_tok">if(isnull($range.latest$), now(), if(isnum($range.latest$), $range.latest$, relative_time(now(), $range.latest$)))</eval>
        <eval token="earliest_str">strftime($earliest_tok$, "%Y.%m.%d")</eval>
        <eval token="latest_str">strftime($latest_tok$ - 1, "%Y.%m.%d")</eval>
      </change>
    </input>

In order to have right earliest_str and latest_str just after opening the dashboard we have to initialize them in the init section of the dashboard:

  <init>
    <eval token="earliest_tok">relative_time(now(), "-7d@w0")</eval>
    <eval token="latest_tok">relative_time(now(), "@w0")</eval>
    <eval token="earliest_str">strftime($earliest_tok$, "%Y.%m.%d")</eval>
    <eval token="latest_str">strftime($latest_tok$ - 1, "%Y.%m.%d")</eval>
  </init>

In this init section the relative date format is to be used: "-7d@w0" and "@w0" which is equivalent to Previous week default value of the date/time picker input control.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

In your dashboard xml, update the stanza for time input to use following relative time range:
Updated

<earliest>-7d@w0</earliest>
<latest>@w0</latest>
0 Karma

fjp2485
Engager

Hi somesoni2,

Thanks for your answer.
You probably meant -1w@w0 instead of -7w, isn't it?

So the complete input section supposed to look like this:

    <input type="time" token="range" searchWhenChanged="true">
      <label>Set Date/Time Range</label>
      <default>
        <earliest>-1w@w0</earliest>
        <latest>@w0</latest>
      </default>
    </input>

Unfortunately the displayed text is "Custom time", see screenshot below:
alt text

But my specification prescribes to show: "Previous week" because this text is more informative for the user.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

That was a typo on my side. I wanted to use -7d@w0. Also, I'm assuming you're launching the dashboard fresh (from navigation menu) after making change so that it's using the default values of the time range picker.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...