Dashboards & Visualizations

Using time token to restrict results in dropdown

shailesh030
Path Finder

I have two dropdown inputs. First drop down is to select time . 2nd drop down is populated using another search but needs to be limited by time range selected in 1st drop down. Below is the form I wrote. I tried using with time token from previous dropdown but it doesn't help in limiting the search. I know that appending search with earliest= and latest= will restrict the results but then I am not able to use the $time$ token.

Is there any way to restrict the search results for 2nd dropdown based on a dynamic time range ?

<form>
  <label>Adhoc Query</label>
  <fieldset autoRun="false" submitButton="true">
    <input type="dropdown" token="time" searchWhenChanged="true">
      <label>Select a Time Range:</label>
      <choice value="-30m@m">Last half hour</choice>
      <choice value="-60m@m">Last 1 hour</choice>
      <choice value="-240m@m">Last 4 hours</choice>
      <choice value="-24h">Last 24 hours</choice>
      <choice value="-48h">Last 2 days</choice>
      <choice value="-10d@d">Last 10 days</choice>
      <default>-30m@m</default>
    </input>
    <input type="dropdown" token="operationname" searchWhenChanged="true">
      <label>Select an Operation:</label>
      <prefix>OpNm="*</prefix>
      <suffix>"</suffix>
      <default>*</default>
      <choice value="*">All</choice>
      <populatingSearch fieldForValue="OpNm" fieldForLabel="OpNm">
        <![CDATA[ sourcetype="abclogskv" | stats count by OpNm]]>
        <earliestTime>$time$</earliestTime>
        <latestTime/>
      </populatingSearch>
    </input>
 </fieldset>
 </form>
0 Karma

shailesh030
Path Finder

Hi! acharlieh,

I had tried that with rich xml editor and it was complaining about invalid XML . This time I changed to plain text and used the same token it worked. I am not sure why though.

Thanks for prompting me to try it out again.

Regards
Shailesh

0 Karma

lennys26
Communicator

Hi Shailesh. Just so you know, I also have issues with the rich XML editor in both IE and Chrome. I now always use a separate editor.

0 Karma

shailesh030
Path Finder

Thanks lenny.. I will also be avoiding rich XML editor

0 Karma

acharlieh
Influencer

Why are you not able to use the $time$ token inline?

<populatingSearch fieldForValue="OpNm" fieldForLabel="OpNm">
   <![CDATA[ sourcetype="abclogskv" earliest="$time$" latest=now | stats count by OpNm]]>
</populatingSearch>
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...