i have the following search in my xml:
index= ... earliest=-20d@d latest=+d@d | timechart ... | timewrap ...
How do I control the search using a form? I basically want to be able to control this earliest=-20d@d latest=+d@d
and I only want to increase the value 20
up or down. Maybe I should use some other type of form control?
This is my 1st attempt:
<label>Timeframe</label>
<default>
<earliestTime>-20d</earliestTime>
<latestTime>now</latestTime>
</default>
Hi HatNZ,
If i undertanded well your task, try with xml code that follow: with this, you can specify either -20d ,-30d or more in the input text. It work fine!
Try to run it!
<form>
<label>time</label>
<fieldset submitButton="true">
<input type="text" token="time_tok">
<label>Specify a time</label>
<default>-20d</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=_internal | stats count by sourcetype |head 10</query>
<earliest>$time_tok$</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</form>
Hi ,
As you have adapted your code,if it produce no error it is ok. now try this:
1- create an input for integer .
2-use the input token like this:
index= ... earliest=-$time_tok$d@d
latest=+d@d | timechart ... |
timewrap ...
3- you can even remove "earliest=-" and "d@d" and put them in fieldset as token prefix and token suffix.
the query will now be:
index= ... $time_tok$
latest=+d@d | timechart ... |
timewrap ...
Hi HatNZ,
If i undertanded well your task, try with xml code that follow: with this, you can specify either -20d ,-30d or more in the input text. It work fine!
Try to run it!
<form>
<label>time</label>
<fieldset submitButton="true">
<input type="text" token="time_tok">
<label>Specify a time</label>
<default>-20d</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=_internal | stats count by sourcetype |head 10</query>
<earliest>$time_tok$</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</form>
tks, I adapted that to do something like this.
<input type="text" token="time_tok">
<label>Specify a time</label>
<default>-20d@d</default>
</input>
index= ... earliest=$time_tok$ latest=+d@d | timechart ... | timewrap ...
this way i am controlling from earliest=$time_tok$
part using the input
what do you want now? Are you satisfy?
Here is an example:
<form >
<label>Single Value Customization: Panel Color</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="time" searchWhenChanged="true">
<label/>
<default>
<earliestTime>0</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
<input type="dropdown" token="index" searchWhenChanged="true">
<label>Choose one index</label>
<choice value="*">All</choice>
<populatingSearch fieldForLabel="index" fieldForValue="index">| eventcount summarize=false index=* OR index=_*</populatingSearch>
<default>*</default>
</input>
</fieldset>
<row>
<single id="id1">
<title>Count of all events in index=$index$</title>
<searchString>index=$index$ OR index=_$index$|stats count</searchString>
<earliestTime>$time.earliest$</earliestTime>
<latestTime>$time.latest$</latestTime>
<option name="field">count</option>
<option name="beforeLabel">There is</option>
<option name="afterLabel">Total Events</option>
<option name="underLabel">All events</option>
</single>
</row>
</form>
I speciffically want to be able to control this in the search earliest=-20d@d
changing it to this earliest=-30d@d
or this earliest=-40d@d
for example. Maybe i am taking the wrong approach.