Archive

Adding time selector to dashboard panel on dbx query

Splunk Employee
Splunk Employee

Hello,

We have a dashboard panel that does a query for a set of data for the last 7 days. Is there a way to place a dropdown time selector next to the dashboard panel and pass a variable to the dbx search query to change the time frame?

0 Karma
1 Solution

Explorer

I think posting your XML would be helpful because I'm not sure where you're getting the error.

Here is a stripped down basic example of a dropdown with 4 options, which are used to drive the output of a SQL query against an Oracle database named "mydb". Try this out on your system and see if helps




  

  
    pulldown_time_range
    Time Range (Hours):  
    
      
         Last Hour
         1              
        
      
         Last Day
         24    
      
      
         Last Week
         168
                    
      
         Last Month
         744              
                
      
    
        | dbquery mydb "select to_char(sysdate, 'YYYY-MM-DD HH24:MI:SS') current_ts, $pulldown_time_range$ pulldown_time_range_hours, to_char(sysdate-($pulldown_time_range$/24), 'YYYY-MM-DD HH24:MI:SS') pulldown_ts from dual"
       
          false
       
            
  


View solution in original post

0 Karma

Explorer

I think posting your XML would be helpful because I'm not sure where you're getting the error.

Here is a stripped down basic example of a dropdown with 4 options, which are used to drive the output of a SQL query against an Oracle database named "mydb". Try this out on your system and see if helps




  

  
    pulldown_time_range
    Time Range (Hours):  
    
      
         Last Hour
         1              
        
      
         Last Day
         24    
      
      
         Last Week
         168
                    
      
         Last Month
         744              
                
      
    
        | dbquery mydb "select to_char(sysdate, 'YYYY-MM-DD HH24:MI:SS') current_ts, $pulldown_time_range$ pulldown_time_range_hours, to_char(sysdate-($pulldown_time_range$/24), 'YYYY-MM-DD HH24:MI:SS') pulldown_ts from dual"
       
          false
       
            
  


View solution in original post

0 Karma

Explorer

Cool, glad to be of help. Sorry for the confusion with the capitalization. It looks right when I edit the text above, but then goes to all lower case when I come back to review the page.

0 Karma

Splunk Employee
Splunk Employee

Got it working. Thanks for all your help!

0 Karma

Explorer

AaronKorn, I do see a problem in the pasted syntax now that I look closer. For some reason the code tags are taking the capital "P" out of the "layoutPanel" tag and that will definately cause it to not work right since its case sensitive.

Change all of the "layoutpanel" text to be "layoutPanel" and try it again as a view.

0 Karma

Explorer

Are you creating a "dashboard" or a "view"?

This XML will only work in a view. If you try pasting it into a dashboard and then save it all you will get is a blank screen because the syntax is not simple-XML formatted.

0 Karma

Splunk Employee
Splunk Employee

Still nothing. Even when I copy this xml straight to a new blank dashboard nothing appears.

0 Karma

Explorer

First question would be, do you have the SideView Utils app installed?

If not that's probably the root issue since the Pulldown tag is sideview specific.

0 Karma

Splunk Employee
Splunk Employee

yes it is installed.

0 Karma

Explorer

Are you looking for a date range picker type solution, or a simple dropdown with some static time ranges?

I've used Sideview Utils to define some static dropdowns which pass parameters to searches with succcess using the an example snippet like the one below


...


dropdown_timerange
Time Range:


Last Day
24



Last Hour
1




Last Week
168



Last Month
744



<module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
      <param name="search">| dbquery yourdb "select * from your_table where (sysdate-time_field)*24 between 1 and $dropdown_timerange$ </param>
      <module name="SimpleResultsTable">
        <param name="displayRowNumbers">false</param>
      </module>
 </module

...

Splunk Employee
Splunk Employee

So I tried adding this to the advanced xml and got:

Misconfigured view 'ESM_Test' - layoutPanel is not defined for module Pulldown

Misconfigured view 'ESM_Test' - layoutPanel is not defined for module SideviewUtils

found an invalid value for layoutPanel - 'None'

Any ideas?

0 Karma

Explorer

Unfortunately I think Sideview is only usable in Advanced-XML, but perhaps someone else has a way of accomplishing the same task with native functionality in Simple-XML.

If your dashboard isn't overly complex I'd really recommend taking the leap to the advanced XML code though. Most stuff translates pretty easily, and while it is slightly more complicated you also gain quite a bit of flexibility as to what tools you have at your disposal, and how they can be utilized.

0 Karma

Splunk Employee
Splunk Employee

Thanks for the feedback. Is there a way to do this in the simplified xml view?

0 Karma