Splunk Search

Time picker doesn't pass time to search?

belle501
Path Finder

Hey everyone, I'm building a simple dashboard to show some info about SFTP traffic. I'm using a time picker to pick the time range of the data, but whatever I do, it doesn't seem to pass the time to the search.

My code is as follows:

<form>
  <label>SFTP Dashboard</label>
  <description>SFTP Traffic Info</description>
  <search id="main_search">
    <query>
          index=postnl source=postnl_ftp_files_hits 
          | rename session_id AS id 
          | join type=left id 
              [ search index=postnl source=postnl_ftp_sessions ] 
          | where isnotnull(ip_addr) AND size > 0 
          | eval time_duration=round(strptime(time_ended, "%F %T.%3N") - strptime(time_started, "%F %T.%3N"),1) 
          | stats values(ip_addr) AS "IP Address", values(time_started) AS "Start Time", values(time_ended) AS "End Time", values(time_duration) AS "Duration (seconds)", count(name) AS "File Count", sum(size) AS Size, values(name) AS Name BY id 
          | eval Size=round(Size/1000,2) 
          | rename id AS "Session ID", Size AS "Size (KB)" 
          | rex field=Name "^//(?<Server>[^/]+)/" 
          | eval Server=upper(Server) 
          | eval Server=mvdedup(Server) 
          | lookup PostNL_SFTP_server_applicatie_lookup.csv Server OUTPUT Application 
          | sort 0 id 
    </query>
    <earliest>$time$</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Main Table ($time$)</title>
      <table>
        <search base="main_search">
          <query>| table "Session ID", "IP Address", "Start Time", "End Time", "Duration (seconds)", "File Count", "Size (KB)", Server, Application</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="size">
          <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="number" field="size">
          <option name="precision">1</option>
          <option name="useThousandSeparators">false</option>
        </format>
        <format type="color" field="ID">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="Size (KB)">
          <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="color" field="Duration (seconds)">
          <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="color" field="Session ID">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="File Count">
          <colorPalette type="minMidMax" maxColor="#1E93C6" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
      </table>
    </panel>
  </row>
</form>

After picking a time the dashboard panel will just keep saying Search is waiting for input.... It's probably a simple thing, but I can't figure it out. Anyone have any suggestions?

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @belle501,

Try to change earliest & latest in search.
Form :

<earliest>$time$</earliest>
<latest>now</latest>

TO :

<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>

OR

<earliest>$earliest$</earliest>
<latest>$latest$</latest>

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @belle501,

Try to change earliest & latest in search.
Form :

<earliest>$time$</earliest>
<latest>now</latest>

TO :

<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>

OR

<earliest>$earliest$</earliest>
<latest>$latest$</latest>

belle501
Path Finder

Ah, thank you! Adding that to the token worked. 🙂

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...