I want to hide progress bar in dashboard panels. Everything in the dashboard is working fine. Since I added the auto refresh of the dashboard every few minutes in the form, I want to hide the progress. Documentation at http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/PanelreferenceforSimplifiedXML#search says 'refresh.display' option can be used. it did not work. Is the syntax supposed to be different or is there any other option that I can try? I appreciate the help. Here is sample code. <form **refresh="30**" hideSplunkBar="true" hideFooter="true" hideEdit="true"> ... ... <row> <panel> <table> <search> <query>| savedSearch xxx </query> </search> <option name="link.openSearch.visible">false</option> <option name="link.inspectSearch.visible">false</option> <option name="link.exportResults.visible">false</option> **<option name="refresh.display">false</option>** <option name="list.drilldown">full</option> <option name="list.wrap">1</option> <option name="maxLines">1</option> <option name="raw.drilldown">none</option> <option name="rowNumbers">false</option> <option name="table.drilldown">none</option> <option name="table.wrap">1</option> <option name="type">list</option> <option name="wrap">true</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="count">1</option> </table> </panel> </row> </form Thanks ... View more

Hello, Receiving an error when trying to access the time token in the search I have defined an input time field to use in the search. There are two items I am looking for: 1) I want the chart populated with default times such as for past 3 days (earliest=-3d and latest =now) 2) When user chooses a time token I want to pass the earliest time to the search in the chart ** My Label <row> <panel> <input type="time" searchWhenChanged="true" token="time_input_tok"> <label>Select a time:</label> <default> <earliest>earliest=-3d@h</earliest> <latest>now</latest> </default> </input> <chart> <title>My title</title> <searchString> [ search index=xxxx| head 1 | eval earliest=$time_input_tok.earliest$ | eval latest=$time_input_tok.earliest$+259200 | table earliest,latest | format "(" "(" "" ")" "OR" ")" ] index=xxxx sourcetype=aaa |fields TA, TM |timechart span=5min Max(TM), Avg(TA) </searchString> <earliestTime>$time_input_tok.earliest$</earliestTime> <latestTime>$time_input_tok.latest$</latestTime> <searchString> . . . ** The search in the above chart is translated like this one below and erring because earliest time is not being populated in search. [search index=xxxx| head 1 | eval earliest= | eval latest=+259200 |table earliest, latest | format "(" "(" "" ")" "OR" ")" ] index=xxxx sourcetype=aaaa | fields TA, TM | timechart span="5min" max(TM), avg(TA) Here is the error in the dashboard chart: Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression ... View more

Hello, Here is the the description of process and what I am looking for. User is aware of zooming in chart, but wants a second chart in drill down with click. 1) This is the first time chart search index=xxxx sourcetype=aaaa earliest=-7d latest=now | fields TA, TM| timechart span=15m max(TM), avg(TA) 2) From this chart when user clicks a point I want to add and subtract some time to use for next chart. token="selected_time">$click.value$ 3) Here is the second time chart search index=xxxx sourcetype=aaaa earliest="$calculated_earliest_time$" latest=$calculated_latest_time$" | fields TA, TM| timechart span=1sec max(TM), avg(TA) Example of calculated_earliest_time and calculated_latest_time in the above query calculated_earliest_time = selected_time - 30 minutes calculated_latest_time = selected_time + 30 minutes. Although I can add eval functions to restrict the time frame by using pipe I do not want the second search redeing events that are outside the the sepcified time range. I want to use calculated time fields in beginning of the second time chart search. ... View more