topic Re: Use token in the dropdown choice value in Dashboards & Visualizations

Use token in the dropdown choice value

karthi25 — Mon, 05 Feb 2018 09:34:12 GMT

I have a dropdown with choice values as follows:

        <label>SELECT A TASK NAME</label>

        <choice value="taskName='aaa' status='COMPLETED'| sort -splunkLogId | eval startDateModified= strptime( startDate, &quot;%Y-%m-%d %H:%M:%S&quot;) | eval newDateFromDash = relative_time($dashboardTime.latest$(), &quot;$dashboardTime.earliest$&quot;)
 | where startDateModified > newDateFromDash | eval runDate = strftime(strptime(startDate, &quot;%Y-%m-%d&quot;),&quot;%Y-%m-%d&quot;) |chart sum(rowCount) over runDate">aaa</choice>

        <choice value="taskName='bbb' status='COMPLETED'| sort -splunkLogId |eval startDateModified= strptime( startDate, &quot;%Y-%m-%d %H:%M:%S&quot;) | eval newDateFromDash = relative_time($dashboardTime.latest$(), &quot;$dashboardTime.earliest$&quot;)
 | eval runDate = strftime(strptime(startDate, &quot;%Y-%m-%d&quot;),&quot;%Y-%m-%d&quot;) |chart sum(rowCount) over runDate">bbb</choice>
        .....
        <selectFirstChoice>true</selectFirstChoice>
      </input>

"dashboardTime" is nothing but my time select box token. But the choice value is not getting update with the corresponding values of $dashboardTime.latest$ and $dashboardTime.earliest$ instead it is update with the string "$dashboardTime.latest$ " and "$dashboardTime.earliest$".
Can anyone please suggest me to do it.

Re: Use token in the dropdown choice value

493669 — Mon, 05 Feb 2018 09:39:58 GMT

also share my time select box query to understand better

Re: Use token in the dropdown choice value

bojanisch — Mon, 05 Feb 2018 10:41:12 GMT

Have you set searchWhenChanged = true on the time range picker?

Alternatively why do you parse the time token in your queries? I suggest you to use a changed snippet that transforms the time string constraint directly into an epoch value that can be used in your queries:

<change>
    <eval token="earliest">if(isnum($time.earliest$), $time.earliest$, relative_time(now(), $time.earliest$))</eval>
    <eval token="latest">if(isnum($time.latest$), $time.latest$, relative_time(now(), $time.latest$))</eval>
</change>

You can simply add this to the input definition of your time range picker and use the new tokens $earliest$ and $latest$ for time comparisons. You could also add more tokens and formations, depending on your needs.

Oh and by the way, in your example (your first query) you also need to escape > into > .