All Apps and Add-ons

Change search query by time range

philip_wong
Communicator

Can I create a dashboard that the searches depend on time range selected?

For my case, I want to query 24 hours data from original index and timechart span=5min
When user selected time range larger than 24 hours, then it will search data from summary index and with timechart span=1h.

Does TimeRangePicker allow such customization?
Or I need to use Sideview?

Philip

1 Solution

ziegfried
Influencer

There's a "hack" that allows you to choose a different summary index as the query-source depending on the selected timerange:

<your search> [ stats count | addinfo | eval range=info_max_time - info_min_time | eval search=if(range<=86400, "index=summary1", "index=summary2") ]

So this will expand to index=summary1 <your search> if the selected timerange is less than a day and index=summary2 <your search> otherwise.

Unfortunately this can't be used to alter the span parameter for the timerange command.

View solution in original post

ziegfried
Influencer

There's a "hack" that allows you to choose a different summary index as the query-source depending on the selected timerange:

<your search> [ stats count | addinfo | eval range=info_max_time - info_min_time | eval search=if(range<=86400, "index=summary1", "index=summary2") ]

So this will expand to index=summary1 <your search> if the selected timerange is less than a day and index=summary2 <your search> otherwise.

Unfortunately this can't be used to alter the span parameter for the timerange command.

philip_wong
Communicator

Thank you so much! I think it can really solve my problem.

I'd like to learn more.

  1. "addinfo" allows us to post-process the search?
  2. Is it a must to have "stats count"?
  3. If I need to run a timechart here, so it should be done by this?

[ stats count | addinfo | eval range=info_max_time - info_min_time | eval search=if(range<=86400, "index=summary1", "index=summary2") ] | timechart count

I think span is not a big concern

0 Karma

Ayn
Legend

If you don't explicitly specify a span for timechart it will pick an appropriate span automatically, which should be the easiest way of solving what you want to accomplish.

0 Karma

philip_wong
Communicator

Yes... badly it becomes my next problem now...
I tried to fix the span=5m. But it's fine to retrieve per 1h data from summary index for 7 days. But if I change the range to 30 days, it will show nothing in timechart!

0 Karma

Ayn
Legend

Ah, I missed the part of using the summary index instead of the default, sorry. To my knowledge this is not possible to do (or at least not easily done).

0 Karma

philip_wong
Communicator

Indeed I have tried. Seems Splunk won't choose span=5min. (I guess 15min is the default minimal)

And I still have problem to make my index to be dynamic...

Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...