topic Re: Dynamic Dropdown Using Timepicker in Dashboards & Visualizations

Dynamic Dropdown Using Timepicker

IRHM73 — Tue, 11 Apr 2017 06:44:34 GMT

Hi, I wonder whether someone could help me please.

I'm trying to create a dynamic drop down where the values of the 'user' drop down menu will be dependent on the time range selected.

This is the code I've put together:

<form>
  <label>Analysis of Splunk users activity</label>
  <fieldset submitButton="false">
    <input searchWhenChanged="true" token="timerange" type="time">
      <label>Time range:</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="user">
      <label>field1</label>
      <search>
        <query>(index=_audit action=search) OR (index=_internal) between $timerange.earliest$ and $timerange.latest$
| dedup user
| stats count by user
| fields user
| sort +user</query>
      </search>
      <fieldForLabel>user</fieldForLabel>
      <fieldForValue>user</fieldForValue>
      <choice value="*">All</choice>
    </input>
  </fieldset>
</form>

But I can't get the drop down menu to populate with the correct users.

I just wondered whether someone could look at this please and offer some guidance on how I may go about achieving this and where I've gone wrong?

Many thanks and kind regards

Chris

Re: Dynamic Dropdown Using Timepicker

aholzel — Tue, 11 Apr 2017 08:45:35 GMT

you should add the time range below the search between earliest and latest brackets ( just like the timerange input):

<form>
   <label>Analysis of Splunk users activity</label>
   <fieldset submitButton="false">
     <input searchWhenChanged="true" token="timerange" type="time">
       <label>Time range:</label>
       <default>
         <earliest>@d</earliest>
         <latest>now</latest>
       </default>
     </input>
     <input type="dropdown" token="user">
       <label>field1</label>
       <search>
         <query>(index=_audit action=search) OR (index=_internal)
 | dedup user
 | stats count by user
 | fields user
 | sort +user</query>
       </search>
         <earliest>$timerange.earliest$</earliest>
         <latest>$timerange.latest$</latest>
       <fieldForLabel>user</fieldForLabel>
       <fieldForValue>user</fieldForValue>
       <choice value="*">All</choice>
     </input>
   </fieldset>
 </form>

Re: Dynamic Dropdown Using Timepicker

niketn — Tue, 11 Apr 2017 08:52:39 GMT

Only way to include global time picker tokens in Inputs like dropdown would be to use earliest and latest in the base query itself earliest=$timerange.earliest$ latest=$timerange.latest$. Input controls will not allow you to define <earliest> and <latest> nodes for time picker token selection.

Also if you are using dedup on user, you don't need to add stats again (both will perform the same task so you can finally use table user command).

      <input type="dropdown" token="user">
        <label>Select User</label>
       <search>
         <query>(index=_audit action=search) OR (index=_internal) earliest=$timerange.earliest$ latest=$timerange.latest$
 | dedup user
 | sort user
 | table user</query>
       </search>
       </search>
       <fieldForLabel>user</fieldForLabel>
       <fieldForValue>user</fieldForValue>
       <choice value="*">All</choice>
     </input>
   </fieldset>

Re: Dynamic Dropdown Using Timepicker

IRHM73 — Tue, 11 Apr 2017 09:54:24 GMT

Hi @niketnilay, thank you for taking the time to reply. The solution works great.

Many thanks and kind regards

Chris

Re: Dynamic Dropdown Using Timepicker

IRHM73 — Tue, 11 Apr 2017 09:55:57 GMT

Hi @aholzel, thank you for taking the time to reply. Unfortunately it didn't quite work as expected, but as you can see I was able to achieve the expected results from the solution provided by @niketnilay.

Many thanks and kind regards

Chris

Re: Dynamic Dropdown Using Timepicker

niketn — Tue, 11 Apr 2017 11:37:12 GMT

Anytime Chris... Glad it worked! 🙂

Re: Dynamic Dropdown Using Timepicker

svenfurrer — Tue, 23 Jan 2018 21:50:48 GMT

Hi @aholzel
If you include the and tags within the your solution works for me and prevents the search from failling when you choose "All time" in the time picker.
Thanks
Sven

Re: Dynamic Dropdown Using Timepicker

Ashwini008 — Tue, 25 Aug 2020 07:12:13 GMT

@niketn I am using customized global time picker. I am pulling data from DB and I need to pass these tokens of global time picker in my DB query to pull the data according to selected presets.

Global time picker consists of :24HRS,LAST7DAYS,LAST30DAYS,BETWEEN,SINCE.

dbxquery connection=AXI_WER query="select * from SPLUNK.TOOL_TABLE" shortnames=t|eval DATE= strftime(strptime(DATE,"%Y%m%d"),"%m/%d/%Y %H:%M:%S") |eval DATE= strptime(DATE,"%m/%d/%Y %H:%M:%S") |search DATE>=$lowerdate.earliest$ AND DATE<=$lowerdate.latest$ |table SYSTEM

P.S. Format of DB DATE FIELD-YYYYMMDD (20200929)

In highlighted part I am able to pass BETWEEN SINCE presets and it works fine. could you please suggest me how to pass other tokens in the query i.e.24hrs,last7days,last30days.

I have reached dead end with my options, so any help would be great!

Thank you.

Re: Dynamic Dropdown Using Timepicker

niketn — Tue, 25 Aug 2020 11:25:54 GMT

@Ashwini008 refer to another answer by me with couple of workarounds to set the required tokens based on time input selection. One of the uses input change event handler and other one which is more dynamic uses an independent search: https://community.splunk.com/t5/Archive/Running-one-of-two-searches-based-on-time-picker-selection/td-p/364411