topic Re: Create filter with month names in the dashboard in Dashboards & Visualizations

Create filter with month names in the dashboard

antonio147 — Wed, 10 Nov 2021 07:38:02 GMT

Hi all,
i created a report, now i need to create a dashboard that takes data from this report with loadjob savedsearch.
the report has as the name of the fields 1_month_previous, 2_month_previous, ......(I could not rename the names of the months in the command stats sum (DIM) as 1_month_previous, I also followed a post here in the community)
I would like to create a filter in the dashboard with the names of the months instead of the previous_month.
I tried with this code:
<query> | makeresults
| eval MPR0 = strftime (relative_time (now (), "-0month @ month"), "% B")
| eval MPR1 = strftime (relative_time (now (), "-1month @ month"), "% B")
| eval MPR2 = strftime (relative_time (now (), "-2month @ month"), "% B")
| eval MPR3 = strftime (relative_time (now (), "-3month @ month"), "% B")
| eval MPR4 = strftime (relative_time (now (), "-4month @ month"), "% B")
| eval MPR5 = strftime (relative_time (now (), "-5month @ month"), "% B")
| eval MPR6 = strftime (relative_time (now (), "-6month @ month"), "% B")
| eval MPR7 = strftime (relative_time (now (), "-7month @ month"), "% B")
| eval MPR8 = strftime (relative_time (now (), "-8month @ month"), "% B")
| eval MPR9 = strftime (relative_time (now (), "-9month @ month"), "% B")
| eval MPR10 = strftime (relative_time (now (), "-10month @ month"), "% B")
| eval MPR11 = strftime (relative_time (now (), "-11month @ month"), "% B")

| eval MONTH = mvappend (MPR0, MPR1, MPR2, MPR3, MPR4, MPR5, MPR6, MPR7, MPR8, MPR9, MPR10, MPR11)
| table MONTH </query>
but in Dinamic Option -> Search String by inserting this code, it returns me the names of the months separated by commas, all on a single row and not in a column to let me choose the month I need.
Do you have any suggestions?

I have tried mv append, split, delim, etc .. to no avail.
I ask for help from you Splunk gurus.
Tks
BR
Antonio

Re: Create filter with month names in the dashboard

ITWhisperer — Wed, 10 Nov 2021 08:05:54 GMT

Here's a way that works in SimpleXML - hopefully you can translate to Dashboard Studio

<input type="dropdown" token="previousmonth"> <label>Past 12 months</label> <search> <query>| makeresults | eval month=mvrange(1, 13) | mvexpand month | eval month=0-month | eval _time=relative_time(_time,month."mon@mon") | eval month=strftime(_time,"%B") | table month</query> </search> <fieldForLabel>month</fieldForLabel> <fieldForValue>month</fieldForValue> </input>

Re: Create filter with month names in the dashboard

antonio147 — Wed, 10 Nov 2021 08:14:29 GMT

Hi ITWhisperer,
thanks for the quick response.
I tried your code and it works.
I found another suggestion from you regarding this request that worked just the same.
Now, however, I would like the current month (now: November) to be in first place and the previous month immediately below, and so on .....
Also since I have the 1_month_previous field in the original report I have to take those values in that field.
I thought about transforming the name of the month into its value and adding the _precedent_month suffix so as to have the field written.
Do you think it is the optimal solution or is there something better? 🙂
In any case, thanks for your invaluable help and suggestion.

Re: Create filter with month names in the dashboard

ITWhisperer — Wed, 10 Nov 2021 08:29:42 GMT

<input type="dropdown" token="previousmonth"> <label>Past 12 months</label> <search> <query>| makeresults | eval mon=mvrange(1, 13) | mvexpand mon | eval mon=mon-1 | eval month=if(mon>0,(0-mon)."mon","") | eval fieldname=if(mon>0,mon."_month_previous","now") | eval _time=relative_time(_time,month."@mon") | eval month=strftime(_time,"%B") | table month fieldname</query> </search> <fieldForLabel>month</fieldForLabel> <fieldForValue>fieldname</fieldForValue> </input>

Re: Create filter with month names in the dashboard

antonio147 — Wed, 10 Nov 2021 08:57:48 GMT

IT Whisperer, you are great !!!!
Thank you so much, in 2 minutes you solved a problem that I had not been able to overcome for days.
You're great !!!
Tks