How to get token value and _time value from a single dropdown in a dashboard?

gwalford — Mon, 16 May 2022 17:01:17 GMT

How can I pull 3 tokens from a single dropdown search? - I would like our users to select the case_idz, and have the _time value populate from the same dropdown (I know I can append this to the individual searches with the case_idz token, but that seems very brute force and inelegant.)

Here is the populating search:

| tstats count WHERE index=cases BY source, _time
| fields source, _time
| rex field=source max_match=0 "^[A-Z]:\\\\([^\\\\]*)\\\\([^\\\\]*)\\\\(?P<case_idz>[^\\\\]*)"
| stats count by case_idz, _time
| fields case_idz, _time
| stats earliest(_time) AS earliest_event, latest(_time) AS latest_event by case_idz
| convert ctime(earliest_event) ctime(latest_event)

Which gives a table of:

case_idz earliest_event latest_event

I would like to turn each of these into a token:

$case_idz$ $earliest_event$ $latest_event$

The case_idz is the value that they need to pivot off of, and the earliest_event and latest_event are the second and third tokens that I would like to leverage to set the earliest and latest time values for the searches.

Other than taking components of this search and adding it to each and every dashboard, how can I have the three variables trigger in one pass?

Re: How to get token value and _time value from a single dropdown in a dashboard?

gwalford — Mon, 16 May 2022 18:28:55 GMT

I figured it out - I needed to use the done functionality to make it work from the table:

<done>
<set token="case_num">$result.case_idz$</set>
<set token="earliest_event">$result.earliest_event$</set>
<set token="latest_event">$result.latest_event$</set>
</done>

I also needed to remove the ctime conversion, and leave it in UNIX time. Works now!

topic Re: How to get token value and _time value from a single dropdown in a dashboard? in Splunk Search

How to get token value and _time value from a single dropdown in a dashboard?

Re: How to get token value and _time value from a single dropdown in a dashboard?