As in the dashboard tutorial for Splunk 6, I'm happy converting panels from reports into inline searches. However, it seems: add input --> time, works differently than Splunk 6's "add time range picker" option. The latter generates this XML:
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true">
<default>
*whatever the user sets*
</default>
</input>
</fieldset>
whereas the former yields:
<fieldset submitButton="false">
<input type="time" token="field1">
<label/>
<default>
<earliestTime>0</earliestTime>
<latestTime/>
</default>
</input>
</fieldset>
Is the functionality of adding a time range picker preserved in 6.1?
In either case, creating a dynamic dashboard---which updates its panels with the changing of a time input---seemingly requires us to edit the XML directly, if only to delete the auto-generated time ranges ( <earliestTime> & <latestTime> ) for clones of reports. Is there a solution making use purely of functionality in the GUI?
... View more