Dashboards & Visualizations

Shared Time picker is missing from Input (even in 6.5)

lakromani
Builder

I do use a lot of Input to narrow down my graphs in my dashboard.

Since I do not like the drop down list in the input to be flooded, I like to use the same global time picker in Input as well in Panel.

If I add a Panel, I can go to Edit Search->Time Range Scope and select Shared Time Picker(some name)
But if I do the same for an Input, I only have the button for selecting a time range. No option for selecting the Shared Time Picker

Workaround is to do it manually by using earliest, latest option.

    <input type="dropdown" token="Host" searchWhenChanged="true">
      <search>
        <query>sourcetype=master |
          top host</query>
        <earliest>$global_time.earliest$</earliest>
        <latest>$global_time.latest$</latest>
      </search>
      <choice value="*">Any</choice>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <default>*</default>
    </input>

This is equal to the setup done for the Panel

So my request is that this is fixed in next version.
I did hope this was fixed in 6.5, but it was not.


UPDATE:
This example should explain the problem.
Look at line 15 and 16. There you see the Global_Time used in the input.
It can be done using source edit, but not from the gui edit.

<form>
  <label>dctest3</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="Global_Time">
      <label>`Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="Host" searchWhenChanged="true">
      <search>
        <query>index=main |
          top host</query>
        <earliest>$Global_Time.earliest$</earliest>
        <latest>$Global_Time.latest$</latest>
      </search>
      <choice value="*">Any</choice>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=main host=$Host$ |stats count by host</query>
          <earliest>$Global_Time.earliest$</earliest>
          <latest>$Global_Time.latest$</latest>
        </search>
        <option name="drilldown">row</option>
      </table>
    </panel>
  </row>
</form>

This picture is from the Panel and show the correct Time Range Scope
You can see the Global Time selected.
alt text

.

Now, take a look at time range section for the Input
You can only select the built in value and not the Global Time from the Time Input
alt text

Tags (2)
0 Karma

dbcase
Motivator

I tried this in simple XML and the time picker was visible. Was that what you were looking for?

<dashboard>
  <label>dctest3</label>
  <row>
    <panel>

      <input type="time" token="field1" searchWhenChanged="true">
      <label>Select a Time Period</label>
      <default>
        <earliest>-6h</earliest>
        <latest>now</latest>
      </default>
    </input>

      <table>
        <search>
          <query>index=main|stats count by host</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">undefined</option>
        <option name="rowNumbers">undefined</option>
        <option name="drilldown">row</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

lakromani
Builder

Hi, I updated my post, by modifying your example. The Host input should not show host outside periode of the Global.Time. Example works correctly, but you need to use Source Edit to create it.

0 Karma

dbcase
Motivator

Yea I'm thinking source edit is going to be the only way you get to what you are looking for.

0 Karma

lakromani
Builder

This I know, but I am surprised that a function like this has not been added to the GUI. It has been like this for a very long time. Lets hope 6.6 will resolve it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...