All Apps and Add-ons

form with timerangepicker to postfilter (sideview utils or intentions?)

brettcave
Builder

I'm building a form that I would like to filter results based on input time range.

Basically have a timerangepicker or similar component, and when the time range is selected, apply it into a search in a specific format.

e.g, to build a report that contains ALL host data, but only for hosts that reported an error within a time range specified by the picker:

<module name="TimeRangePicker"><module name="Button">
<module name="Search">
  <param name="search">
   [ search earliest="$timerange.earliest$" latest="$timerange.latest$" eventtype="SomeSortOfError" | dedup host | fields + host ] .....
  </param>
</module>
</module></module>

So from the example above, I'm looking to try get the time range from the picker into the sub-search, that is used to filter the results.

Any ideas on how to get this?

0 Karma
1 Solution

brettcave
Builder

Stumbled across the answer: http://splunk-base.splunk.com/answers/77362/timerangepicker-as-intention

 <module name="Search">
  <param name="search">search * [search earliest="$search.timeRange.earliest$" latest="$search.timeRange.latest$" | dedup host | fields host ] | timechart count 
  <param name="earliest">-24h</param>
  <param name="latest">now</param>

View solution in original post

0 Karma

brettcave
Builder

Stumbled across the answer: http://splunk-base.splunk.com/answers/77362/timerangepicker-as-intention

 <module name="Search">
  <param name="search">search * [search earliest="$search.timeRange.earliest$" latest="$search.timeRange.latest$" | dedup host | fields host ] | timechart count 
  <param name="earliest">-24h</param>
  <param name="latest">now</param>
0 Karma

brettcave
Builder

Correct, that's what I am trying to do. The TRP is used as a filter of objects (users registering within a certain time period in my case), while the report needs to be across all data.

0 Karma

sideview
SplunkTrust
SplunkTrust

If your intention is to apply the TRP's timerange to just the subsearch, and to run the outer search over the past 24 hours always, then you are absolutely correct. Just posting this comment to make sure.

For others reading who DONT need to do this nuanced use case, if you simply want to run both inner and outer subsearches over the given timerange, it happens automatically and you don't need to do any of this. ie you would just delete earliest="$search.timeRange.earliest$" latest="$search.timeRange.latest$" entirely and let the TimeRangePicker automatically submit its timerange.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...