I've implemented Table row expansion with custom Javascript from Splunk 6.x Dashboard examples. The Expanded section's query does not use the same time range as the rest of the panels.
What changes would I have to make in the javascript so the expanded data is of the same time range as the primary query? Also the expansion does not seem to work if the Value to be expanded is more than one word long. Any solution for this as well?
For example, I've given the time range as yesterday. Now total count for 'mongod' is 30 but when we expand the row in the y-axis, the values are from 0-400 which means the shared time picker has not affected the expanded query which comes in from the custom JS.
You can also try adding earliest and latest within the search query itself.
See if this gets you going on setting the earliest
and latest
while creating the seachManager
and thereby using the time input's token's earliest
and latest
selected values for the new search on expansion of row:
http://dev.splunk.com/view/SP-CAAAEW2
Something like:
"earliest_time": "$myTimeInputToken.earliest$"
Thanks for your reply gokadrioid.
I added the below snippet to the JS-
this._searchManager.set({
search: 'sourcetype=xxxxx URL_root=xxxxx "https://www.xxxxx.com" clientcompanyname=' + clientcompanynameCell.value + ' | stats count(xxxxx) as "Number of Visits", count as "Number of Hits" By xxxxxxx| sort "Number of Visits" desc',
"earliest_time": '$myTimeInputToken.earliest$', //I also tried '$Time.earliest$'
"latest_time": '$myTimeInputToken.latest$'});
But I see an error "Invalid earliest_time" when I expand the section on the dashboard.
P.S: I tried earliest_ time without double quotes as well. I've zero knowledge of JS so just mentioning it, in case it does make a difference.
Is the token name of your time input myTimeInputToken
? Use whatever is the name of your time input token.