topic Re: How to dynamically change the span parameter in bucket without using drop down options. in Deployment Architecture

How to dynamically change the span parameter in bucket without using drop down options.

karthikeyan_k14 — Mon, 14 Aug 2017 12:53:31 GMT

I have a search like this:

index=* source=*|....| bucket Time span=(1d/1h/5m)...| 
if I select last one month from time picker, span would auto change as 1d ..bucket Time span=1d in query
if I select last one day from time picker, span would auto change as 1h ..bucket Time span=1h in query.
if I select last one hour from time picker, span would auto change as 5m ..bucket Time span=5m in query.

A condition is that I can't use drop down for span....but timepicker for selecting for date and time.

can anyone help me on this query

Re: How to dynamically change the span parameter in bucket without using drop down options.

sbbadri — Tue, 29 Sep 2020 15:21:15 GMT

<form>
<label>testspandynamicchange</label>
<fieldset submitButton="true" autoRun="true">
<input type="time" token="time_tok" searchWhenChanged="false">
<label>select a time range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
<change>
<condition match="relative_time(now(), $time_tok.latest$) - relative_time(now(), $time_tok.earliest$) >= 86400">
<set token="stok">1h</set>
</condition>
<condition match="relative_time(now(), $time_tok.latest$) - relative_time(now(), $time_tok.earliest$) >= 3600">
<set token="stok">5m</set>
</condition>
<condition match="relative_time(now(), $time_tok.latest$) - relative_time(now(), $time_tok.earliest$) >= 2629743">
<set token="stok">1d</set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=_internal sourcetype=splunkd group=pipeline | timechart span=$stok$ count by group</query>
<earliest>$time_tok.earliest$</earliest>
<latest>$time_tok.latest$</latest>
</search>
</table>
</panel>
</row>
</form>

Re: How to dynamically change the span parameter in bucket without using drop down options.

niketn — Mon, 14 Aug 2017 15:58:00 GMT

@karthikeyan_k14, just FYI, if you use timechart first two should default span to what your are looking. Only for the third one it will be 1m by default not 5m.

Re: How to dynamically change the span parameter in bucket without using drop down options.

DalJeanis — Tue, 15 Aug 2017 03:44:19 GMT

@sbbadri - Order of the first two is reversed. You need to test 3600 before you test 86400.