topic Re: Comparing data based on user-selected options from a dropdown menu. in Dashboards & Visualizations

Comparing data based on user-selected options from a dropdown menu.

Gauri — Tue, 13 Feb 2024 08:49:49 GMT

"I need to create a dashboard with two queries in one dashboard, one query having a fixed time range of "Today" and the other query needs to select "earliest and latest" from the drop down. The data dropdown will have two values "Yesterday" and "last week". Last week is the day from last week (if today is Feb 13, last week should show data from Feb Feb 06)"

for.eg

index="abc" sourcetype="Prod_logs"
| stats count(transactionId) AS TotalRequest (***earliest and latest needs to be derived as per user selection from drop down)
| appendcols [search index="abc" sourcetype="Prod_logs" earliest=@d latest=now (****Today's data****)
| stats count(transactionId) AS TotalRequest]

Re: Comparing data based on user-selected options from a dropdown menu.

gcusello — Tue, 13 Feb 2024 09:27:16 GMT

Hi @Gauri,

in the dropdown list insert the following fixed choices:

earliest=-d@d earliest=-w@w

then in the search use the dropdown token:

index="abc" sourcetype="Prod_logs" $token$ latest=now | eval day=if(strftime(_time,"%Y-%m-%d")=strftime(now(),"%Y-%m-%d"),"Today","Previous") | stats count(transactionId) AS TotalRequest BY day

Ciao.

Giuseppe

Re: Comparing data based on user-selected options from a dropdown menu.

ITWhisperer — Tue, 13 Feb 2024 09:34:15 GMT

Try something like this

<input type="dropdown" token="timeperiod" searchWhenChanged="true"> <label>Select day</label> <choice value="earliest=-1d@d latest=@d">Yesterday</choice> <choice value="earliest=-7d@d latest=-6d@d">Last week</choice> </input>

Then use the $timeperiod$ token in your first search

Re: Comparing data based on user-selected options from a dropdown menu.

Gauri — Wed, 14 Feb 2024 09:09:35 GMT

How can I get the complete date time format for both the queries in graph,

for eg.

index="abc" sourcetype="Prod_logs"
| eval "yesterday_datetime_formatted" = strftime(_time,"%Y-%m-%d %H:%M:%S")
| stats count(transactionId) AS TotalRequest by yesterday_datetime_formatted URI (***earliest and latest needs to be derived as per user selection from drop down)
appendcols [search index="abc" sourcetype="Prod_logs" earliest=xxx, latest=now
| eval "Today_datetime_formatted" = strftime(_time,"%Y-%m-%d %H:%M:%S")
| stats count(transactionId) AS TotalRequest by Today_datetime_formatted URI]

| fields "yesterday_datetime_formatted" "Today_datetime_formatted"

Re: Comparing data based on user-selected options from a dropdown menu.

ITWhisperer — Wed, 14 Feb 2024 09:38:13 GMT

Please give us a mock-up of what your desired output would look like

Re: Comparing data based on user-selected options from a dropdown menu.

Gauri — Wed, 14 Feb 2024 10:27:43 GMT

Below query is what I am trying to execute, In the Statistics I am getting the data correctly with correct dates but in graph I am getting same date for both Yesterday & Today.

for.eg. Today is 14th and Yesterday is 13th, I am getting the date 13th in Visualization for both the days.

index="abc" sourcetype="Prod_logs" (***earliest and latest needs to be derived as per user selection from drop down)
| eval "yesterday_datetime_formatted" = strftime(_time,"%Y-%m-%d %H:%M:%S")
| stats count(transactionId) AS TotalRequest by "yesterday_datetime_formatted" URI
| eval "Uptime SLI" = *****some formula*****,
"Latency SLI Yesterday" = *****some formula*****
appendcols [search index="abc" sourcetype="Prod_logs" earliest=@d, latest=now
| eval "Today_datetime_formatted" = strftime(_time,"%Y-%m-%d %H:%M:%S")
| stats count(transactionId) AS TotalRequest by "Today_datetime_formatted" URI
| eval "Uptime SLI" = *****some formula*****,
"Latency SLI Today" = *****some formula*****
]

| fields "today_datetime_formatted" "Latency SLI Today" "yesterday_datetime_formatted" "Latency SLI Yesterday"

Re: Comparing data based on user-selected options from a dropdown menu.

gcusello — Wed, 14 Feb 2024 11:39:19 GMT

Hi @Gauri ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Comparing data based on user-selected options from a dropdown menu.

ITWhisperer — Wed, 14 Feb 2024 11:57:50 GMT

Please give us a mock-up of what your desired output would look like