topic Help with Creating a Dynamic Dropdown for Months and Year in Dashboards & Visualizations

Help with Creating a Dynamic Dropdown for Months and Year

johnward4 — Wed, 07 Mar 2018 02:50:45 GMT

I'm trying to create dropdown menus, one for the Month and another for the Year, that use dynamic options and timepicker 'today' to default to Current Month and Current Year. I have tested that part successfully.

My question is I'm looking to fill the rest of my dropdown menus 'Month' and 'Year' with previous months and years so I can also search historical data. I have been testing using output lookup tables but I don't have a lot of experience using that option and hoping the community has a few possible options to try out.

Testing query :

index=* 
| eval Time=strftime(_time, "%m/%d/%Y %I:%M:%S %p")
| rex field=Time "(?<date_month>\d+)/"
| rex field=Time "(?<date_year>\d{4})"
| dedup date_month
| dedup date_year
| table date_month, date_year
| output date_lookup

Re: Help with Creating a Dynamic Dropdown for Months and Year

HiroshiSatoh — Tue, 29 Sep 2020 18:19:46 GMT

Try this!

| dedup date_month
| dedup date_year
↓
| dedup date_month,date_year

Re: Help with Creating a Dynamic Dropdown for Months and Year

johnward4 — Wed, 07 Mar 2018 18:40:57 GMT

Thanks @HiroshiSatoh Have you worked with populating dropdown menus dynamically or with lookups before?

Re: Help with Creating a Dynamic Dropdown for Months and Year

HiroshiSatoh — Tue, 13 Mar 2018 04:25:43 GMT

It is a sample dynamically setting a dropdown from the event log.

<input type="dropdown" token="yyyymm">
    <label>Target Month</label>
    <populatingSearch fieldForValue="trng" fieldForLabel="yyyymm">
         <![CDATA[source="WinEventLog:System" (EventCode=6005 OR EventCode=6006) | table _time | eval yyyymm=strftime(_time,"%m/%Y")|dedup yyyymm| eval sdate=substr(yyyymm,1,2)+"/01/"+substr(yyyymm,4,4)+":0:0:0" | eval edate=strftime(relative_time(strptime(sdate,"%m/%d/%Y:%H:%M:%S"),"+1month"),"%m/%d/%Y:%H:%M:%S")  |  eval trng="earliest="+sdate+" latest="+edate]]>
    </populatingSearch>
</input>