<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to change the group by clause in timechart command depending on selected value in drop-down? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-the-group-by-clause-in-timechart-command-depending/m-p/253763#M15849</link>
    <description>&lt;P&gt;I want to change the group by clause in search command depending upon selected value in drop-down box in dashboard&lt;/P&gt;

&lt;P&gt;e.g. Selected value is "All" then group by clause should look like &lt;CODE&gt;timechart sum(x) group by host&lt;/CODE&gt; &lt;BR /&gt;
         else &lt;BR /&gt;
        Selected value is "Environment"  then group by clause should look like &lt;CODE&gt;timechart sum(x) group by  environment&lt;/CODE&gt; &lt;/P&gt;

&lt;P&gt;Thanks,&lt;BR /&gt;
Prashant&lt;/P&gt;</description>
    <pubDate>Fri, 02 Dec 2016 13:05:19 GMT</pubDate>
    <dc:creator>praspai</dc:creator>
    <dc:date>2016-12-02T13:05:19Z</dc:date>
    <item>
      <title>How to change the group by clause in timechart command depending on selected value in drop-down?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-the-group-by-clause-in-timechart-command-depending/m-p/253763#M15849</link>
      <description>&lt;P&gt;I want to change the group by clause in search command depending upon selected value in drop-down box in dashboard&lt;/P&gt;

&lt;P&gt;e.g. Selected value is "All" then group by clause should look like &lt;CODE&gt;timechart sum(x) group by host&lt;/CODE&gt; &lt;BR /&gt;
         else &lt;BR /&gt;
        Selected value is "Environment"  then group by clause should look like &lt;CODE&gt;timechart sum(x) group by  environment&lt;/CODE&gt; &lt;/P&gt;

&lt;P&gt;Thanks,&lt;BR /&gt;
Prashant&lt;/P&gt;</description>
      <pubDate>Fri, 02 Dec 2016 13:05:19 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-the-group-by-clause-in-timechart-command-depending/m-p/253763#M15849</guid>
      <dc:creator>praspai</dc:creator>
      <dc:date>2016-12-02T13:05:19Z</dc:date>
    </item>
    <item>
      <title>Re: How to change the group by clause in timechart command depending on selected value in drop-down?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-the-group-by-clause-in-timechart-command-depending/m-p/253764#M15850</link>
      <description>&lt;P&gt;You can easily do this with the &lt;CODE&gt;&amp;lt;change&amp;gt;&lt;/CODE&gt; option on your input dropdown.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    &amp;lt;input id="split_field" searchWhenChanged="true" token="split_field" type="dropdown"&amp;gt;
      &amp;lt;label&amp;gt;Split-by Field&amp;lt;/label&amp;gt;
      &amp;lt;choice value="all"&amp;gt;All&amp;lt;/choice&amp;gt;
      ...
      &amp;lt;choice value="env"&amp;gt;Environment&amp;lt;/choice&amp;gt;
      &amp;lt;default&amp;gt;all&amp;lt;/default&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;condition label="All"&amp;gt;
          &amp;lt;set token="split_field_opt"&amp;gt;host&amp;lt;/set&amp;gt;
        &amp;lt;/condition&amp;gt;
       ...
        &amp;lt;condition label="Environment"&amp;gt;
          &amp;lt;set token="split_field_opt"&amp;gt;environment&amp;lt;/set&amp;gt;
        &amp;lt;/condition&amp;gt;        
      &amp;lt;/change&amp;gt;
    &amp;lt;/input&amp;gt;
    ...
    &amp;lt;panel&amp;gt;
      &amp;lt;chart&amp;gt;
        &amp;lt;search&amp;gt;&amp;lt;query&amp;gt;YOUR SEARCH | timechart sum(x) group by  $split_field_opt$&amp;lt;/query&amp;gt;&amp;lt;/search&amp;gt;
      &amp;lt;/chart&amp;gt;
    &amp;lt;/panel&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 02 Dec 2016 13:15:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-change-the-group-by-clause-in-timechart-command-depending/m-p/253764#M15850</guid>
      <dc:creator>rjthibod</dc:creator>
      <dc:date>2016-12-02T13:15:36Z</dc:date>
    </item>
  </channel>
</rss>

