How to edit my Simple XML to pass time variables f...

bworrellZP · ‎10-21-2015

Working on this dashboard setup that management wants has presented many interesting challenges. High level, it's a 3 dashboard setup. First one is to show Department level login data. On this page, the only selection they have is the Time variable, which defaults to 30 days. Then the various graphs and charts show data based on Department. When they find a department they want to look at, they click the name.

That takes them to the second Dashboard, which prepopulates the name. They want the date to prepopulate to what ever was on the previous page AND still allow them to change it if needed. This dashboard has all the users in the Department with various data. From there, they want to be able to click on the user and go to the last dashboard, populating the user name and again the previous selected date range, but still allowing them to change it.

I have the values being clicked on for Department and User being passed correctly, but cannot figure out why the time is not working. Used this link as my template. https://answers.splunk.com/answers/289838/how-to-pass-multiple-tokens-and-a-time-range-picke.html

From Page 2 to 3, here is my link (cleaned of server data)

<drilldown>
      <link>https://Servername:8000/en-US/app/search/alpha_3?form.limit=$click.name2$&amp;earliest=$Time.earliest$&amp;latest=$Time.latest$</link>
    </drilldown>

Here is the first part of page 3,

<form>
  <label>Alpha_3</label>
  <fieldset autoRun="true" submitButton="true">
    <input type="text" token="limit" searchWhenChanged="true">
      <label>Please select a User ID</label>
      <fieldForLabel>UserID</fieldForLabel>
      <fieldForValue>UserID</fieldForValue>
    </input>
    <input type="time" token="time" searchWhenChanged="true">
      <label>Please select search time window</label>
      <default>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </default>
      <fieldForLabel>time</fieldForLabel>
      <fieldForValue>time</fieldForValue>
    </input>
  </fieldset>

  <row>
    <panel>
      <html>

         <a href=" https://Servername/en-US/app/search/alpha_1">Return to Alpha 1</a>

               </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>User Mapping</title>
        <search>
          <query>index="user_mapping" UserID="$limit$" |dedup Key | eval Start_Date=strftime(StartDate/1000, "%m-%d-%Y") | eval Term_Date=strftime(TerminationDate/1000, "%m-%d-%Y")| table UserID,EmployeeName, 
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>
        </search>
      </table>
    </panel>
  </row>

Anyone see the error with my setup?

Thanks in advance.

somesoni2 · ‎10-21-2015

What you have to do is to pass the time range from current dashboard to the timerange of 2nd dashboard, providing the token name. Update your drilldown section to this (i.e. if you have input type="time" with token name="time", then pass the current dashboard's timerange ($time.earliest$) to time.earliest in the next dashboard)

 <drilldown>
       <link>https://Servername:8000/en-US/app/search/alpha_3?form.limit=$click.name2$&amp;time.earliest=$time.earliest$&amp;time.latest=$time.latest$</link>
     </drilldown>

bworrellZP · ‎10-22-2015

Somesoni,

Made the changes, only get "invalid earliest_time".

On the page I am going too, here is the search string.

<panel>
  <table>
    <title>User Mapping</title>
    <search>

``index="user_mapping" UserID="$limit$" |dedup Key | eval Start_Date=strftime(StartDate/1000, "%m-%d-%Y") | eval Term_Date=strftime(TerminationDate/1000, "%m-%d-%Y")| table UserID,EmployeeName,
$time.earliest$
$time.latest$

Changing from t to T did not change it. I must be missing something. Thoughts?

somesoni2 · ‎10-22-2015

I copied from your example and that had mismatched case for the time.

Here is what you have to ensure
1) All dashboard , base OR drilldown, should have same time input configuration (token name).

<input type="time" token="time" searchWhenChanged="true">
       <label>Please select search time window</label>
       <default>
         <earliest>$Time.earliest$</earliest>
         <latest>$Time.latest$</latest>
     </input>

2) Wherever this time range has to be used, including panel searches, form input populating searches and drilldowns, use same case of $time.earliest$ and $time.latest$. (for drilldown url, set the time.earliest with $time.earliest$ and time.latest with $time.latest$

These two steps should fix the issue for you.

bworrellZP · ‎10-22-2015

I seem to still be missing something. In all the chart sections I put $Time.earliest$
$Time.latest$ in them as well.

Think that means I did not do something in your number 2 above.

Should I use something else?

Thanks

How to edit my Simple XML to pass time variables from one dashboard to another?

Introducing the 2024 SplunkTrust!

Introducing the 2024 Splunk MVPs!

Splunk Custom Visualizations App End of Life