Splunk Search

user defined search time in a dashboard

jalfrey
Communicator

I'm busy designing dashboards. I really like the ability to specify the time window which appears in the search app. Is there any way to add similar functionality to a dashboard? I imagine there would be some button or text box in the dashboard to let you set the time range.

Tags (3)
0 Karma

jalfrey
Communicator

I think my mistake was putting the picker on the simple xml page. I'll try to get it working in the complex xml

0 Karma

linu1988
Champion
0 Karma

linu1988
Champion

Ok this is a advanced xml command. It may not work in simple xml. I haven't worked in simple xml to tell you what will work in there.

0 Karma

rroberts
Splunk Employee
Splunk Employee

You cant use the module element in the simple dashboard xml. You can create a form view and add a TimePicker. But you'll have to create the XML with a form root element from scratch. There is no editor for a form view.

See .... http://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms

Alternatively you can convert your dashboard to Advanced XML and then use the module element. This is also documented at the link above.

0 Karma

jalfrey
Communicator

I found this article http://splunk-base.splunk.com/answers/84697/how-to-set-timerangepicker-as-realtime-by-default
So I edited one of my dashboard.xml files and added the following lines:




last_30_days


I get an empty spot where the control should be. What's wrong?

0 Karma

linu1988
Champion

yes there is It's our friendly TimeRangePicker Module. Put the content in that module and make it available for manual time selection. Thanks!!

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...