All Apps and Add-ons

Two timerangepickers for one search (advanced XML). Tokens for time or smth?

iKate
Builder

Hi! How can one add two timerangepickers to one search in advanced xml?

I've used simple xml form with its tokens for time inputs and it worked well, but simple xml still has constraints like I cannot select several options in a drilldown and it's crucial in my case. So I need to rebuild form into advanced xml (using SideView features) and don't see how to cope with my time ranges.

The suggestion from this answer cannot be applied as both of timeranges should be custom
http://answers.splunk.com/answers/77362/timerangepicker-as-intention

Thanks

UPDATE:

This is how the result looks in simple xml, and needed the same but in advanced to have possibility to select several options in pulldowns. OR alternative question: how to select several options in pulldowns in simple xml?:)
alt text

1 Solution

sideview
SplunkTrust
SplunkTrust

It's possible in Advanced XML. There are a couple different ways.

You need to be using Sideview Utils and it helps to be pretty familiar with the ValueSetter module. Read the ValueSetter docs thoroughly if you haven't already.

1) When you need two timerange pickers, they need to be custom timeranges, and they need to both potentially apply to the same search.

solution: use a Pulldown not a TimeRangePicker. Have the values comma separated and use the ValueSetter's delim param to split the single value into two values, then they can be used as the timerange, or as a part of the search.

To get two pulldowns just add a second pulldown. As long as your tokens dont collide you can have two or as many as you like.

<module name="Pulldown" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="name">customTimeString</param>
  <param name="label">Timerange </param>
  <param name="staticOptions">
    <list>
      <param name="label">last 15 minutes</param>
      <param name="value">-15min@min,@min</param>
    </list>
    <list>
      <param name="label">last 60 minutes</param>
      <param name="value">-60min@min,@min</param>
    </list>
    <list>
      <param name="label">Yesterday night</param>
      <param name="value">-1d@d+18h,@d</param>
    </list>
  </param>

  <module name="ValueSetter">
    <param name="name">customTime</param>
    <param name="value">$customTimeString$</param>
    <param name="delim">,</param>

    <module name="Search">
      <param name="search"><![CDATA[
        index=_internal source="*metrics.log" group="per_sourcetype_thruput" | stats max(eps) sum(kb) by series
      ]]></param>
      <param name="earliest">$customTime[0]$</param>
      <param name="latest">$customTime[1]$</param>

      <module name="HTML">
        <param name="html"><![CDATA[
          <h3>$results.count$ results $results.timeRange.label$</h3>
        ]]></param>
      </module>
      <module name="JobProgressIndicator" />
      <module name="Pager">
        <module name="Table"></module>
      </module>
    </module>
  </module>
</module>

2) The other way is if you need them to be TimeRangePicker modules. With this way however you can't customize the timerange options that appear in each pulldown - they'll both have whatever times.conf says they should.

<module name="TimeRangePicker">
  <param name="default">Last 24 hours</param>

  <module name="ValueSetter">
      <param name="name">stashedEarliest</param>
      <param name="value">$search.timeRange.earliest$</param>

      <module name="ValueSetter">
        <param name="name">stashedLatest</param>
        <param name="value">$search.timeRange.latest$</param>

        <module name="TimeRangePicker">
          <param name="default">Last 24 hours</param>

          <!--  At this point the second TimeRangePicker has clobbered the first 
          However you still can use the first as $stashedLatest$ and $stashedEarliest$
          -->
        </module>
      </module>
    </module>
  </module>
</module>

View solution in original post

sowings
Splunk Employee
Splunk Employee

Have you looked at the app "Splunk 6 Dashboard Examples"? http://apps.splunk.com/app/1603/ The chrome in your screenshot looks like Splunk 6, so I thought I'd mention the app. It has examples for multi-select, and multi-checkbox, in addition to the ability to do two time range pickers natively. I haven't experimented with the latter yet to provide a working example, but it might be worth checking out.

0 Karma

iKate
Builder

@sowings thank you! I'll surely install and check it!

0 Karma

sideview
SplunkTrust
SplunkTrust

It's possible in Advanced XML. There are a couple different ways.

You need to be using Sideview Utils and it helps to be pretty familiar with the ValueSetter module. Read the ValueSetter docs thoroughly if you haven't already.

1) When you need two timerange pickers, they need to be custom timeranges, and they need to both potentially apply to the same search.

solution: use a Pulldown not a TimeRangePicker. Have the values comma separated and use the ValueSetter's delim param to split the single value into two values, then they can be used as the timerange, or as a part of the search.

To get two pulldowns just add a second pulldown. As long as your tokens dont collide you can have two or as many as you like.

<module name="Pulldown" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="name">customTimeString</param>
  <param name="label">Timerange </param>
  <param name="staticOptions">
    <list>
      <param name="label">last 15 minutes</param>
      <param name="value">-15min@min,@min</param>
    </list>
    <list>
      <param name="label">last 60 minutes</param>
      <param name="value">-60min@min,@min</param>
    </list>
    <list>
      <param name="label">Yesterday night</param>
      <param name="value">-1d@d+18h,@d</param>
    </list>
  </param>

  <module name="ValueSetter">
    <param name="name">customTime</param>
    <param name="value">$customTimeString$</param>
    <param name="delim">,</param>

    <module name="Search">
      <param name="search"><![CDATA[
        index=_internal source="*metrics.log" group="per_sourcetype_thruput" | stats max(eps) sum(kb) by series
      ]]></param>
      <param name="earliest">$customTime[0]$</param>
      <param name="latest">$customTime[1]$</param>

      <module name="HTML">
        <param name="html"><![CDATA[
          <h3>$results.count$ results $results.timeRange.label$</h3>
        ]]></param>
      </module>
      <module name="JobProgressIndicator" />
      <module name="Pager">
        <module name="Table"></module>
      </module>
    </module>
  </module>
</module>

2) The other way is if you need them to be TimeRangePicker modules. With this way however you can't customize the timerange options that appear in each pulldown - they'll both have whatever times.conf says they should.

<module name="TimeRangePicker">
  <param name="default">Last 24 hours</param>

  <module name="ValueSetter">
      <param name="name">stashedEarliest</param>
      <param name="value">$search.timeRange.earliest$</param>

      <module name="ValueSetter">
        <param name="name">stashedLatest</param>
        <param name="value">$search.timeRange.latest$</param>

        <module name="TimeRangePicker">
          <param name="default">Last 24 hours</param>

          <!--  At this point the second TimeRangePicker has clobbered the first 
          However you still can use the first as $stashedLatest$ and $stashedEarliest$
          -->
        </module>
      </module>
    </module>
  </module>
</module>

iKate
Builder

It's an honour for me to be answered by @sideview:)
To be honest I haven't noticed module ValueSetter yet, maybe because we updated SideviewUtils to 2.7 just several days ago)
Seems the second variant you suggested can work well for me. Thank you!

0 Karma

ShaneNewman
Motivator

If you are ok with using advanced XML, download the deployment monitor app. The license_info.xml is a great example of how to do what you want.

0 Karma

ShaneNewman
Motivator

Well, I don't really see how that is going to be possible... The first one, highest priority, will have to encompass the time range of the downstream. If the one downstream is more broad than the upstream selection, you will still only get data for the range upstream.

0 Karma

iKate
Builder

Thanks for try but it's quite not what is needed, as in license_info timerangepickers simply belong to different Hiddensearch modules. And I'm interested in case when they can be used in one search module.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...