All Apps and Add-ons

After enabling table row expansion, how to edit Javascript to use the same time range from the primary search in the expanded section's search?

prateedshetty
Path Finder

I've implemented Table row expansion with custom Javascript from Splunk 6.x Dashboard examples. The Expanded section's query does not use the same time range as the rest of the panels.

What changes would I have to make in the javascript so the expanded data is of the same time range as the primary query? Also the expansion does not seem to work if the Value to be expanded is more than one word long. Any solution for this as well?

For example, I've given the time range as yesterday. Now total count for 'mongod' is 30 but when we expand the row in the y-axis, the values are from 0-400 which means the shared time picker has not affected the expanded query which comes in from the custom JS.

0 Karma

rshah_splunk
Splunk Employee
Splunk Employee

You can also try adding earliest and latest within the search query itself.

0 Karma

gokadroid
Motivator

See if this gets you going on setting the earliest and latest while creating the seachManager and thereby using the time input's token's earliest and latest selected values for the new search on expansion of row:

http://dev.splunk.com/view/SP-CAAAEW2

Something like:
"earliest_time": "$myTimeInputToken.earliest$"

0 Karma

prateedshetty
Path Finder

Thanks for your reply gokadrioid.

I added the below snippet to the JS-

  this._searchManager.set({ 
search: 'sourcetype=xxxxx URL_root=xxxxx "https://www.xxxxx.com" clientcompanyname=' + clientcompanynameCell.value + ' | stats count(xxxxx) as "Number of Visits", count as "Number of Hits" By xxxxxxx| sort "Number of Visits"  desc',
"earliest_time": '$myTimeInputToken.earliest$', //I also tried '$Time.earliest$'
"latest_time": '$myTimeInputToken.latest$'});

But I see an error "Invalid earliest_time" when I expand the section on the dashboard.

P.S: I tried earliest_ time without double quotes as well. I've zero knowledge of JS so just mentioning it, in case it does make a difference.

0 Karma

gokadroid
Motivator

Is the token name of your time input myTimeInputToken? Use whatever is the name of your time input token.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...