Dashboards & Visualizations

How to add a time picker in a dashboard which uses a hidden saved search

sheeba
New Member

We would like to add a time picker in our dashboard which uses a hidden saved search. I am looking forward for using different time ranges in our dashboard. It would be nice to have the option to have it load real time, based on a pre-run saved search, and also based on a time range specified.

Tags (2)
0 Karma
1 Solution

lguinn2
Legend

Add a TimeRangePicker module within the HiddenSavedSearch. I put some example code at the end of this answer.

Following are links to 3 apps: I learned more about building dashboards from these 3 apps than from reading the manuals - they are all free and I recommend them highly. I learn best by examples and use the manuals just for detailed info. It is best to install these apps on a personal copy of Splunk, not production.

Splunk Enterprise 6 Dashboard Examples

Splunk Dashboard Examples

Splunk UI examples app for 4.1+

 <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" autoRun="True">
    <param name="savedSearch">My Saved Search Name</param>
    <module name="TimeRangePicker">
      <param name="searchWhenChanged">True</param>
      <param name="selected">Last 15 minutes</param>
      <module name="SimpleResultsTable"/>
    </module>
  </module>

View solution in original post

sheeba
New Member

Thank you for the answer.

But i am looking for more of a search swap module. By default it should use the hidden savedSearch, otherwise dashboard should change with the timerange picker.

0 Karma

sheeba
New Member

Yes, i tried but the chart is not reflecting the data corresponding to the selected time range.

0 Karma

lguinn2
Legend

I am not sure what your statement means.

Did you try this?

0 Karma

lguinn2
Legend

Add a TimeRangePicker module within the HiddenSavedSearch. I put some example code at the end of this answer.

Following are links to 3 apps: I learned more about building dashboards from these 3 apps than from reading the manuals - they are all free and I recommend them highly. I learn best by examples and use the manuals just for detailed info. It is best to install these apps on a personal copy of Splunk, not production.

Splunk Enterprise 6 Dashboard Examples

Splunk Dashboard Examples

Splunk UI examples app for 4.1+

 <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1" autoRun="True">
    <param name="savedSearch">My Saved Search Name</param>
    <module name="TimeRangePicker">
      <param name="searchWhenChanged">True</param>
      <param name="selected">Last 15 minutes</param>
      <module name="SimpleResultsTable"/>
    </module>
  </module>

View solution in original post

vsingla1
Communicator

These 3 apps are really amazing. Thanks.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!