Time picker doesn't pass time to search?

[belle501]

Hey everyone, I'm building a simple dashboard to show some info about SFTP traffic. I'm using a time picker to pick the time range of the data, but whatever I do, it doesn't seem to pass the time to the search.

My code is as follows:

<form>
  <label>SFTP Dashboard</label>
  <description>SFTP Traffic Info</description>
  <search id="main_search">
    <query>
          index=postnl source=postnl_ftp_files_hits 
          | rename session_id AS id 
          | join type=left id 
              [ search index=postnl source=postnl_ftp_sessions ] 
          | where isnotnull(ip_addr) AND size > 0 
          | eval time_duration=round(strptime(time_ended, "%F %T.%3N") - strptime(time_started, "%F %T.%3N"),1) 
          | stats values(ip_addr) AS "IP Address", values(time_started) AS "Start Time", values(time_ended) AS "End Time", values(time_duration) AS "Duration (seconds)", count(name) AS "File Count", sum(size) AS Size, values(name) AS Name BY id 
          | eval Size=round(Size/1000,2) 
          | rename id AS "Session ID", Size AS "Size (KB)" 
          | rex field=Name "^//(?<Server>[^/]+)/" 
          | eval Server=upper(Server) 
          | eval Server=mvdedup(Server) 
          | lookup PostNL_SFTP_server_applicatie_lookup.csv Server OUTPUT Application 
          | sort 0 id 
    </query>
    <earliest>$time$</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Main Table ($time$)</title>
      <table>
        <search base="main_search">
          <query>| table "Session ID", "IP Address", "Start Time", "End Time", "Duration (seconds)", "File Count", "Size (KB)", Server, Application</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="size">
          <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="number" field="size">
          <option name="precision">1</option>
          <option name="useThousandSeparators">false</option>
        </format>
        <format type="color" field="ID">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="Size (KB)">
          <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="color" field="Duration (seconds)">
          <colorPalette type="minMidMax" maxColor="#D6563C" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
        <format type="color" field="Session ID">
          <colorPalette type="sharedList"></colorPalette>
          <scale type="sharedCategory"></scale>
        </format>
        <format type="color" field="File Count">
          <colorPalette type="minMidMax" maxColor="#1E93C6" minColor="#FFFFFF"></colorPalette>
          <scale type="minMidMax"></scale>
        </format>
      </table>
    </panel>
  </row>
</form>

After picking a time the dashboard panel will just keep saying Search is waiting for input.... It's probably a simple thing, but I can't figure it out. Anyone have any suggestions?

[kamlesh_vaghela · Accepted solution]

Hi @belle501,

Try to change earliest & latest in search.
Form :

<earliest>$time$</earliest>
<latest>now</latest>

TO :

<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>

OR

<earliest>$earliest$</earliest>
<latest>$latest$</latest>

[belle501]

Ah, thank you! Adding that to the token worked. 🙂