Dashboards & Visualizations

Panel not updating when changing the time range picker

jasoncorbett
Explorer

Hi,

Backstory:
I'm trying to create 2 dashboards with 1 time range picker. Panel #1 uses the default time using the time range picker and Panel #2 will show the exact same time range but 1 week ago using other tokens defined in the time range picker.

I seem to have an issue with the time range picker and updating the panel #2 when i change the time. When i first start the dashboard, the dashboard will run correctly. But when i go to change the time again, panel #2 doesn't update. And when i go to change the time again, panel #2 will display the results from the previous time.

Any ideas?

Below is the code i have:

<fieldset submitButton="false" autoRun="true">
     <input type="time" token="time" searchWhenChanged="true">
       <label>Current Time</label>
       <default>
         <earliest>1501034400</earliest>
         <latest>1501120800</latest>
       </default>
       <change>
         <eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
         <eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
       </change>
     </input>

         <title>Panel#1</title>
         <search>
           <query>`search string`</query>
           <earliest>$time.earliest$</earliest>
           <latest>$time.latest$</latest>
         </search>

 <title>Panel#2</title>
         <search>
           <query>`search string`</query>
           <earliest>$earliest_offset$</earliest>
           <latest>$latest_offset$</latest>
         </search>
0 Karma
1 Solution

niketn
Legend

Feed the earliest and latest tokens to dummy search to perform eval to set relative_time.

  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Current Time</label>
      <default>
        <earliest>1501034400</earliest>
        <latest>1501120800</latest>
      </default>
    </input>
  </fieldset>
  <search>
    <query>| makeresults
    | eval EarliestTime=$time.earliest$
    </query>
    <progress>
      <eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
      <eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
    </progress>
  </search>
  <row>
    <panel>
      <html>
        <div>earliest_offset: $earliest_offset$</div>
        <div>latest_offset: $latest_offset$</div>
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

sbbadri
Motivator

<form>
<label>testtr</label>
<fieldset submitButton="false">
<input type="time" token="time_tok">
<label>select a time range</label>
<default>
<earliest>1501034400</earliest>
<latest>1501120800</latest>
</default>
<change>
<eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
<eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=_internal group=pipeline</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
</table>
</panel>
</row>
<row>
<panel>
<table depends="$earliest_offset$,$latest_offset$">
<search>
<query>index=_internal group=pipeline earliest=$earliest_offset$ latest=$latest_offset$</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
</table>
</panel>
</row>
</form>

0 Karma

jasoncorbett
Explorer

Thanks sbbadri for your response. I'll give yours a try also.

0 Karma

niketn
Legend

Feed the earliest and latest tokens to dummy search to perform eval to set relative_time.

  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Current Time</label>
      <default>
        <earliest>1501034400</earliest>
        <latest>1501120800</latest>
      </default>
    </input>
  </fieldset>
  <search>
    <query>| makeresults
    | eval EarliestTime=$time.earliest$
    </query>
    <progress>
      <eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
      <eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
    </progress>
  </search>
  <row>
    <panel>
      <html>
        <div>earliest_offset: $earliest_offset$</div>
        <div>latest_offset: $latest_offset$</div>
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jasoncorbett
Explorer

Thanks niketnilay!! I added below and it worked.

<search>
     <query>| makeresults
     | eval EarliestTime=$time.earliest$
     </query>
     <progress>
       <eval token="earliest_offset">relative_time(now(), $time.earliest$) - 604800</eval>
       <eval token="latest_offset">relative_time(now(), $time.latest$) - 604800</eval>
     </progress>
   </search>

Why does it need to be added to a dummy search first?

0 Karma

niketn
Legend

For two reasons, the time earliest and latest provided by time control as snap to time which is being used by the relative_time() function to generate new time.

Dummy search has been made depended on time input token to make sure it resets every time time changes in the input.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...