Splunk Search

user defined search time in a dashboard

jalfrey
Communicator

I'm busy designing dashboards. I really like the ability to specify the time window which appears in the search app. Is there any way to add similar functionality to a dashboard? I imagine there would be some button or text box in the dashboard to let you set the time range.

Tags (3)
0 Karma

jalfrey
Communicator

I think my mistake was putting the picker on the simple xml page. I'll try to get it working in the complex xml

0 Karma

linu1988
Champion
0 Karma

linu1988
Champion

Ok this is a advanced xml command. It may not work in simple xml. I haven't worked in simple xml to tell you what will work in there.

0 Karma

rroberts
Splunk Employee
Splunk Employee

You cant use the module element in the simple dashboard xml. You can create a form view and add a TimePicker. But you'll have to create the XML with a form root element from scratch. There is no editor for a form view.

See .... http://docs.splunk.com/Documentation/Splunk/latest/Viz/Buildandeditforms

Alternatively you can convert your dashboard to Advanced XML and then use the module element. This is also documented at the link above.

0 Karma

jalfrey
Communicator

I found this article http://splunk-base.splunk.com/answers/84697/how-to-set-timerangepicker-as-realtime-by-default
So I edited one of my dashboard.xml files and added the following lines:




last_30_days


I get an empty spot where the control should be. What's wrong?

0 Karma

linu1988
Champion

yes there is It's our friendly TimeRangePicker Module. Put the content in that module and make it available for manual time selection. Thanks!!

0 Karma
Get Updates on the Splunk Community!

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

Unlock Instant Security Insights from Amazon S3 with Splunk Cloud — Try Federated ...

Availability: Must be on Splunk Cloud Platform version 10.1.2507.x to view the free trial banner. If you are ...