Dashboards & Visualizations

change scheduled search timerange with timerangepicker

Starlette
Contributor

I have some HiddenSavedSearches in my dashboard but want to add the timerangepicker to change the timerange from the HiddenSavedSearches.
Configure this with False gives an error, and digin into the uiexamplesapp i noticed the

switcher_time_ui_with_scheduled_jobs example

But here the scheduled timeranges are hardcoded!, so am i right that :
- This is not possible? ( holy cow this should be!)
- If not, what is the way to handle this?

sideview
SplunkTrust
SplunkTrust

depending on the useHistory param, the HiddenSavedSearch module will --

a) when useHistory is True - AND the scheduler has run at least one job for that search, it will show the previous results of that search. If you insert a TimeRangePicker into the hierarchy between HiddenSavedSearch and dispatching modules like SimpleResultsTable, you will get a red error saying this is a configuration error.

b) when useHistory is False, HiddenSavedSearch will act just like a HiddenSearch with that timerange and search entered in. You can place TimeRangePicker's downstream from HiddenSavedSearch and it will work just fine.

It sounds like when you tried setting useHistory to False you got some error, but I think the text of that error is quite important because it should have been fine. There may have been another problem that has nothing to do with this time range issue. What was the exact error you got when you tried setting useHistory to False?

Indeed the ui examples app has a somewhat extreme example using Switcher modules, showing you how you can have different scheduled search results, each from different time ranges, appear when you change the selected option of a PulldownSwitcher module.

0 Karma

sideview
SplunkTrust
SplunkTrust

If you dont want to use the jobs that might have been previously run by the scheduler, then you should use useHistory False. Try it again and paste in any errors that it gives you, because SavedSearch + TimeRangePicker should work fine together in that configuration.

0 Karma

Starlette
Contributor

Youre right, i guess i used the useHistory is True, ( got the config error)
But I tried all the options ( true/false/auto), i am not sure how to use the linkoption but will digin into it, as gnanapaty mentions, to use a macro is not clear to me,,thats just a partly search right?

0 Karma

bwooden
Splunk Employee
Splunk Employee

The HiddenSavedSearch currently shows results of a saved search and will not be influenced by time ranges.

If you would like to search over a dynamic time - you might use the LinkSwitcher to show the HiddenSavedSearch in one child and the TimeRangePicker combined with a HiddenSearch in the second child.

The TimeRangePicker will enable you to choose a time using the same time selection method used in the Search app on the flashtimeline and the HiddenSearch accepts this time range as part of its search criteria.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You could also use a macro withing your HiddenSearch.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...