topic Re: How to pass lookup field values to the time range? in Dashboards & Visualizations

How to pass lookup field values to the time range?

bollam — Sat, 22 Feb 2020 01:51:12 GMT

Hello,

I have a lookup file which has fields Month, earliest, latest. I have drop down name "Month" which gives me the list of all the months from the lookup table. When I choose a month from the drop down the respective values of the earliest and the latest should be passed to the searches or time range token in the dashboard.

Month earliest latest
Jan 01/15/2020:03:34:45 01/15/2020:05:34:45
Feb 02/15/2020:03:34:45 02/15/2020:01:34:45
Mar 03/15/2020:03:34:45 03/15/2020:07:34"45
Apr 04/15/2020:03:34:45 04/15/2020:08:34:45

Re: How to pass lookup field values to the time range?

to4kawa — Sat, 22 Feb 2020 05:00:49 GMT

SAMPLE:

<form>
  <label>lookup to time</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="timepicker" searchWhenChanged="true">
      <label>time piker</label>
      <fieldForLabel>Month</fieldForLabel>
      <fieldForValue>query</fieldForValue>
      <search>
        <query>| makeresults 
| eval _raw="Month earliest latest
Jan 01/15/2020:03:34:45 01/15/2020:05:34:45
Feb 02/15/2020:03:34:45 02/15/2020:01:34:45
Mar 03/15/2020:03:34:45 03/15/2020:07:34:45
Apr 04/15/2020:03:34:45 04/15/2020:08:34:45"
| multikv forceheader=1
| table Month earliest latest
| foreach *est [ eval <<FIELD>> = round(strptime(<<FIELD>>,"%m/%d/%Y:%T"))]
| eval query="(earliest=".earliest." "."latest=".latest.")"</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>token value: $timepicker$</html>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal $timepicker$</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>

recommend:

<input type="dropdown" token="timepicker" searchWhenChanged="true">
   <label>time piker</label>
   <fieldForLabel>Month</fieldForLabel>
   <fieldForValue>query</fieldForValue>
   <search>
     <query>| inputlookup your_csv
| foreach *est [ eval <<FIELD>> = round(strptime(<<FIELD>>,"%m/%d/%Y:%T"))]
| eval query="(earliest=".earliest." "."latest=".latest.")"</query>
     <earliest>0</earliest>
     <latest></latest>
   </search>
 </input>

please put the token $timepicker$ to your main search.

Re: How to pass lookup field values to the time range?

manjunathmeti — Sat, 22 Feb 2020 05:35:53 GMT

Just thought of sharing this. If date time values are in timeformat %m/%d/%Y:%H:%M:%S, then you can search earliest and latest with them directly. So below query also works.

index=_internal earliest="02/21/2020:05:00:00" latest="02/21/2020:05:05:00"

Re: How to pass lookup field values to the time range?

to4kawa — Sat, 22 Feb 2020 06:37:17 GMT

SearchTimeModifiers

@manjunathmeti , yes.

| inputlookup your_csv
| eval query="(earliest=".earliest." "."latest=".latest.")"

It's OK.

Re: How to pass lookup field values to the time range?

bollam — Sat, 22 Feb 2020 18:29:32 GMT

@to4kawa Thank you! It worked..
But I wanted to use the result of the query to change the token using eval. But it's not working.
I need to check a specific value of the earliest from the result. If it matches then I need to use the token and assign some other value to it.
The token value is not getting effected in the panel. Can you help me on this?

    <input type="dropdown" token="timepicker" searchWhenChanged="true">
       <label>time piker</label>
       <fieldForLabel>Month</fieldForLabel>
       <fieldForValue>query</fieldForValue>
       <search>
         <query>| inputlookup sample_file
 | foreach *est [ eval &lt;&lt;FIELD&gt;&gt; = round(strptime(&lt;&lt;FIELD&gt;&gt;,"%m/%d/%Y:%T"))]
 | eval query="(earliest=".earliest." "."latest=".latest.")"
         <earliest>0</earliest>
         <latest></latest>
       </search>
       <change>
        <eval token="abc">if('query.earliest'= 1577817000, (earliest=1577817000 latest=15777903400), (earliest=1577817000 latest=15777903405))</eval>
        </change>
     </input>
     <panel>
       <html>token value: $timepicker$ $abc$</html>
    </panel>

Re: How to pass lookup field values to the time range?

to4kawa — Sat, 22 Feb 2020 21:35:54 GMT

  <change>
    <eval token="abc">if(mvindex(split($timepicker$,"="),1) = 1577817000,"(earliest=1577817000 latest=1577903400)", "(earliest=1577817000 latest=1577903405)")</eval>
  </change>

query.earliest is nothing.