Dashboards & Visualizations

Is it possible to pass a token to a time picker?

gcusello
SplunkTrust
SplunkTrust

Hi at all,
I tried to pass a token in a drilldown to another dashboard to the default values of the Time Picker but I received the message "invalid earliest_time".

In the Time Picker, I have "Custom time", and opening it, I have the token's names ($TimeFrom$ and $TimeTo$) instead of their values.

Replacing the token's names with the values I see in the Browser address bar (e.g. "-15m" and "now"), the search runs.

In other words: tokens are correctly passed to the secondary dashboard but values aren't being changed in the Time Picker. If instead, I pass my tokens to the dashboard's panels, they correctly run.

This is my code:
in the main dashboard:

<drilldown>
  <link target="_blank">/app/my_app/home_page_overview_servers?TimeFrom=$Time.earliest$&amp;TimeTo=$Time.latest$&amp;System_Type=Server Windows&amp;Stato=severe</link>
</drilldown>

In the secondary dashboard:

<input type="time" token="Time">
  <label>Period</label>
  <default>
    <earliest>$TimeFrom$</earliest>
    <latest>$TimeTo$</latest>
  </default>
</input>

In other words, is it possible to pass a token to a Time Picker?

Bye.
Giuseppe

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi at all,
I insert this solution that I received in .Conf18 that runs:

<panel>
  <single>
    <title>Server Down</title>
    <search base="numero_server">
      <query>
        | where Total=0
        | search Type="Server Windows"
        | stats count
      </query>
      <progress>
        <eval token="parsed.earliest">strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval>
        <eval token="parsed.latest">strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval>
      </progress>
    </search>
    <option name="colorMode">block</option>
    <option name="drilldown">all</option>
    <option name="rangeColors">["0xd93f3c","0xd93f3c"]</option>
    <option name="rangeValues">[0]</option>
    <option name="useColors">1</option>
    <drilldown>
      <link target="_blank">/app/my_app/home_page_overview_servers?TimeFrom=$parsed.earliest$&amp;TimeTo=$parsed.latest$</link>
    </drilldown>
  </single>
</panel>

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi at all,
I insert this solution that I received in .Conf18 that runs:

<panel>
  <single>
    <title>Server Down</title>
    <search base="numero_server">
      <query>
        | where Total=0
        | search Type="Server Windows"
        | stats count
      </query>
      <progress>
        <eval token="parsed.earliest">strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval>
        <eval token="parsed.latest">strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval>
      </progress>
    </search>
    <option name="colorMode">block</option>
    <option name="drilldown">all</option>
    <option name="rangeColors">["0xd93f3c","0xd93f3c"]</option>
    <option name="rangeValues">[0]</option>
    <option name="useColors">1</option>
    <drilldown>
      <link target="_blank">/app/my_app/home_page_overview_servers?TimeFrom=$parsed.earliest$&amp;TimeTo=$parsed.latest$</link>
    </drilldown>
  </single>
</panel>

Bye.
Giuseppe

0 Karma

niketn
Legend

@cusello, I think you have almost got it. You can pass on earliest and latest time tokens from one dashboard to other. However, in your Dashboard QueryString seems like you are not using form tokens i.e. tokens prefixed with form.<inputTokenName>

So, instead of TimeFrom=$Time.earliest$&amp;TimeTo=$Time.latest$&amp; you should use

form.TimeFrom=$Time.earliest$&amp;form.TimeTo=$Time.latest$&amp;

Also the remaining tokens passed from source dashboard to destination would also be form tokens so prefix form.<tokenName> to all of the tokens. Please try out and confirm!

Splunk Dashboard Example App has an example of passing the token from Source to Destination dashboard as well.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gcusello
SplunkTrust
SplunkTrust

I tried using form.TimeFrom and form.TimeTo, but the problem it's the same: it runs passing tokens to the panels, it doesn't run passing tokens to the Time Picker.
I have only a different message: "Search is waiting for input".

It seems that the Time Picker has a different behavior than the other inputs.

Thanks.
Bye.
Giuseppe

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@cusello,

Its possible to pass the time token to another dashboard. Please try the below example.

Dashboard1

<form>
  <label>Time Token</label>
  <fieldset submitButton="false">
    <input type="time" token="time_from_first_dashboard" searchWhenChanged="true">
      <label>Time</label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_*|timechart count by sourcetype</query>
          <earliest>$time_from_first_dashboard.earliest$</earliest>
          <latest>$time_from_first_dashboard.latest$</latest>
        </search>
        <option name="drilldown">cell</option>
        <drilldown>
          <link target="_blank">/app/search/time_second_dashboard?form.time_second_dashboard.earliest=$time_from_first_dashboard.earliest$&amp;form.time_second_dashboard.latest=$time_from_first_dashboard.latest$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

On drilldown , the time parameters from dashboard1 is passed to Dashboard 2

Dashboard2

<form>
  <label>Time_Second_Dashboard</label>
  <fieldset submitButton="false">
    <input type="time" token="time_second_dashboard">
      <label>Time</label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_*|stats count by sourcetype</query>
          <earliest>$time_second_dashboard.earliest$</earliest>
          <latest>$time_second_dashboard.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!
0 Karma

kakar
Explorer

Thank you very much for this post.

It fixed an issue I was struggling for days to fix.

Very easy to follow and can't miss anything.

0 Karma

gcusello
SplunkTrust
SplunkTrust

I already found this solution and runs but it doesn't answer to my question because in this way you're passing the tokens directly to the panels, not to the Time Picker that maintains the default values you setted.
I want to pass the tokens to the Time Picker so I can have the values passed by the drilldown, but I can manually modify the value.

Thank you.
Bye.
Giuseppe

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@cusello, Not really.
For e.g. I have set the default time on the second dashboard to last 15 minutes and it changes on my drilldown to the value passed from the first dashboard.

Try this

  • Set second dashboard default time to 15 minutes and also select 15 minutes
  • Set the time range for the first dashboard to 24 hours and click on the table planel
  • On drilldown to the second dashboard, you should be able to see the time input dropdown to 24 hours which was passed from first dashboard.

Please try and let's know if it doesn't work that way

Happy Splunking!
0 Karma

gcusello
SplunkTrust
SplunkTrust

This was my first solution, using the code in my question, but it doesn't run, I have the error message I described.
Maybe there's an error in my code, but in this way it doesn't run.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...