I would like to be able for users to use a time range picker on a dashboard and then be able to feed those start/end times to a script further in the pipeline. How do I go about doing that?
Thanks.
Craig
If by "further in the pipeline" you mean further down in the search language, then you want to look at the addinfo command. addinfo will add some fields to every row of the incoming results, and notable among them are two fields in particular: info_max_time
, which will be the absolute epochtime value of the timerange's end-time, and info_min_time
, which will be the same but for the timerange's start time. You can then use these like any other field.
addinfo will give you those values as epochtimes, no matter whether the user's selected timerange is a relative timerange or an absolute one.
If by pipeline you mean the view xml, then I'd probably use addinfo
and then use a little PostProcess and a Sideview ResultsValueSetter module to pull those field values down to the client so as to use them in another search, or as arguments to something. There is however also $search.timeRange.earliest$ and $search.timeRange.latest$ that is added by Sideview Utils, and this can be quite useful. However not that if the user's selected timerange is a relative timerange, then these values will simply be the relative values - not the absolute equivalents that you would get from the addinfo
command.