timepicker not working for base search in dashboard

[stwong]

Hi, we added timepicker to a simple dashboard consists of base search as following, but it's not working. Using full search in panels the timepicker works properly. Would anyone please help? We're using 6.5.4. Thanks a lot.

<form>
  <label>Dashboard 1</label>
  <search id="baseSearch">
    <query>sourcetype=syslog
    </query>
    <earliest>$time_tok1.earliest$</earliest>
    <latest>$time_tok1.latest$</latest>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="time_tok1" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-1mon@mon</earliest>
        <latest>@mon</latest>
      </default>
    </input>
  </fieldset>

<search base="baseSearch">
              <query>
                stats count by Type
              </query>
              <earliest>$time_tok1.earliest$</earliest>
              <latest>$time_tok1.latest$</latest>
            </search>

[niketn]

@stwong, your limitation is not from Timepicker, it is actually because of post-processing you have used in the snippet posted here. You should try to incorporate the following:

1) Base search should ideally contain transforming command, you should evaluate all the searches which refer to your base search i.e. baseSearchand ensure that baseSearch only retains the required fields as a result of some transforming (statistical) command like stats or chart etc. Refer to the Best Practices for Post Processing Searches. The post process searches will drop events or timeout if the limitations are breached. Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Best_practices

2) When you use post processing, ideally you do not require earliest and latest tag in post process searches, which will be ignored anyways.

3) You can try out the following example. Since you have used post processing, I expect that you have some other post process searches running in your dashboard and the actual answer might change based on which fields you have used. If there is just one post process search using the base search then Post Processing is obviously not required. As per the dashboard Simple XML snippet, only one field in your example I have use | fields Type, you can extend to the other fields you need.

PS: This is just for testing (or rather make your code work). You should change | fields * with the transforming command you need.
4) If you are not able to use transforming command in your base search due to any of your post process search. You would be better off running independent searches instead of post processing which might perform better and not truncate results/timeout due to limitations of post processing.

<form>
  <label>Dashboard 1</label>
   <search id="baseSearch">
     <query>sourcetype=syslog
     | fields - _*
     | fields Type
     </query>
     <earliest>$time_tok1.earliest$</earliest>
     <latest>$time_tok1.latest$</latest>
   </search>
   <fieldset submitButton="false">
     <input type="time" token="time_tok1" searchWhenChanged="true">
       <label></label>
       <default>
         <earliest>-1mon@mon</earliest>
         <latest>@mon</latest>
       </default>
     </input>
   </fieldset>
   <row>
     <panel>
       <table>
        <search base="baseSearch">
          <query>
           stats count by Type
          </query>
        </search>
       </table>   
     </panel>
   </row>
</form>