Splunk Search

Time picker doesn't pass time to search?

belle501
Path Finder

Hey everyone, I'm building a simple dashboard to show some info about SFTP traffic. I'm using a time picker to pick the time range of the data, but whatever I do, it doesn't seem to pass the time to the search.

My code is as follows:

<form>
  <label>SFTP Dashboard</label>
  <description>SFTP Traffic Info</description>
  <search id="main_search">
    <query>
          index=postnl source=postnl_ftp_files_hits 
          | rename session_id AS id 
          | join type=left id 
              [ search index=postnl source=postnl_ftp_sessions ] 
          | where isnotnull(ip_addr) AND size > 0 
          | eval time_duration=round(strptime(time_ended, "%F %T.%3N") - strptime(time_started, "%F %T.%3N"),1) 
          | stats values(ip_addr) AS "IP Address", values(time_started) AS "Start Time", values(time_ended) AS "End Time", values(time_duration) AS "Duration (seconds)", count(name) AS "File Count", sum(size) AS Size, values(name) AS Name BY id 
          | eval Size=round(Size/1000,2) 
          | rename id AS "Session ID", Size AS "Size (KB)" 
          | rex field=Name "^//(?<Server>[^/]+)/" 
          | eval Server=upper(Server) 
          | eval Server=mvdedup(Server) 
          | lookup PostNL_SFTP_server_applicatie_lookup.csv Server OUTPUT Application 
          | sort 0 id 
    </query>
    <earliest>$time$</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Main Table ($time$)</title>
      <table>
        <search base="main_search">
          <query>| table "Session ID", "IP Address", "Start Time", "End Time", "Duration (seconds)", "File Count", "Size (KB)", Server, Application</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="size">
          <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="number" field="size">
          <option name="precision">1</option>
          <option name="useThousandSeparators">false</option>
        </format>
        <format type="color" field="ID">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="Size (KB)">
          <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="color" field="Duration (seconds)">
          <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="color" field="Session ID">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="File Count">
          <colorPalette type="minMidMax" maxColor="#1E93C6" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
      </table>
    </panel>
  </row>
</form>

After picking a time the dashboard panel will just keep saying Search is waiting for input.... It's probably a simple thing, but I can't figure it out. Anyone have any suggestions?

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @belle501,

Try to change earliest & latest in search.
Form :

<earliest>$time$</earliest>
<latest>now</latest>

TO :

<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>

OR

<earliest>$earliest$</earliest>
<latest>$latest$</latest>

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @belle501,

Try to change earliest & latest in search.
Form :

<earliest>$time$</earliest>
<latest>now</latest>

TO :

<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>

OR

<earliest>$earliest$</earliest>
<latest>$latest$</latest>

belle501
Path Finder

Ah, thank you! Adding that to the token worked. 🙂

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...