topic How to create a conditional graph depending on input parameter? in Splunk Search

How to create a conditional graph depending on input parameter?

jinishshah — Mon, 18 Apr 2022 18:28:11 GMT

Hello,

so I have an input on my dashboard page of either month"01-2022,02-2022" and also quarter"Q1-2022". So depending on the search I want to have my timechart command.

For example: query| timechart span="1mon" count(number) [For month]
query| timechart span="qtr" count(number) [For quarter].

I want query like this:

if [input_month="Q%"] then

query| timechart span="qtr" count(number)

else

query| timechart span="1mon" count(number)

How can I do this ?

Re: Conditional graph depending on input parameter

ITWhisperer — Mon, 18 Apr 2022 18:07:08 GMT

Set up a dropdown with the options and use the token in the search query

query| timechart span=$span$ count(number)

Re: Conditional graph depending on input parameter

jinishshah — Mon, 18 Apr 2022 18:23:15 GMT

@ITWhisperer : Token Input is "Q1-2022" which needs to be interpreted as "qtr" while same Token input if "01-2022","02-2022" needs to be interpreted as "1mon" so cannot directly pass $span$

tried below:

eval span_time=if(input="Q%","qtr","1mon")

| timechart span=span_time count(number)

but gives an error "Error in 'timechart' command: The value for option span (jinmonth) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value."

Re: Conditional graph depending on input parameter

jinishshah — Mon, 18 Apr 2022 18:26:06 GMT

Also I need the values "Q1-2022","01-2022","03-2022" for other calculation so cannot change Token value keeping the Token Label as "Q1-2022","01-2022","03-2022"

Re: Conditional graph depending on input parameter

ITWhisperer — Mon, 18 Apr 2022 18:26:14 GMT

How have you defined your "input"?

Can you add a change handler to set an additional token based on the value chosen?

Re: Conditional graph depending on input parameter

jinishshah — Mon, 18 Apr 2022 18:27:49 GMT

@ITWhisperer Also I need the values "Q1-2022","01-2022","03-2022" for other calculation so cannot change Token value keeping the Token Label as "Q1-2022","01-2022","03-2022"

Re: Conditional graph depending on input parameter

jinishshah — Mon, 18 Apr 2022 18:34:38 GMT

Input is defined as Dropdown:

Label Value

Q1-2022 "Q1-2022"

01-2022 "01-2022"

02-2022 "02-2022"

and I am using this Token values for other calculations

Re: Conditional graph depending on input parameter

ITWhisperer — Tue, 19 Apr 2022 06:51:31 GMT

As I said, you could use a change handler in the input

<input type="dropdown" token="monthquarter" searchWhenChanged="true"> <label>Month/quarter span $monthquarterspan$</label> <choice value="Q1-2022">Q1-2022</choice> <choice value="01-2022">01-2022</choice> <choice value="02-2022">02-2022</choice> <default>Q1-2022</default> <change> <eval token="monthquarterspan">if(substr($monthquarter$,1,1)="Q","qtr","1mon")</eval> </change> </input>

Re: Conditional graph depending on input parameter

jinishshah — Tue, 19 Apr 2022 08:09:13 GMT

@ITWhisperer : what is the syntax for Dashboard Studio. This seems to be syntax for Classic Dashboard.

Syntax format of Dashboard Studio is like below:

"inputs": {

"input_month-year": {

"options": {

"items": [

{

"label": "Q1-2022",

"value": "\"Q1-2022\""

{

"label": "01-2022",

"value": "\"01-2022\""

{

"label": "02-2022",

"value": "\"02-2022\""

{

"label": "03-2022",

"value": "\"03-2022\""

}

"token": "month_year"

"title": "Month-Year",

"type": "input.dropdown"

Re: Conditional graph depending on input parameter

ITWhisperer — Tue, 19 Apr 2022 08:26:38 GMT

Correct - just one of the reasons I don't use Studio for serious dashboards (yet)