Dashboards & Visualizations

Adding time selector to dashboard panel on dbx query

aaronkorn
Splunk Employee
Splunk Employee

Hello,

We have a dashboard panel that does a query for a set of data for the last 7 days. Is there a way to place a dropdown time selector next to the dashboard panel and pass a variable to the dbx search query to change the time frame?

0 Karma
1 Solution

jjdorn
Explorer

I think posting your XML would be helpful because I'm not sure where you're getting the error.

Here is a stripped down basic example of a dropdown with 4 options, which are used to drive the output of a SQL query against an Oracle database named "mydb". Try this out on your system and see if helps




  

  
    pulldown_time_range
    Time Range (Hours):  
    
      
         Last Hour
         1              
        
      
         Last Day
         24    
      
      
         Last Week
         168
                    
      
         Last Month
         744              
                
      
    
        | dbquery mydb "select to_char(sysdate, 'YYYY-MM-DD HH24:MI:SS') current_ts, $pulldown_time_range$ pulldown_time_range_hours, to_char(sysdate-($pulldown_time_range$/24), 'YYYY-MM-DD HH24:MI:SS') pulldown_ts from dual"
       
          false
       
            
  


View solution in original post

0 Karma

jjdorn
Explorer

I think posting your XML would be helpful because I'm not sure where you're getting the error.

Here is a stripped down basic example of a dropdown with 4 options, which are used to drive the output of a SQL query against an Oracle database named "mydb". Try this out on your system and see if helps




  

  
    pulldown_time_range
    Time Range (Hours):  
    
      
         Last Hour
         1              
        
      
         Last Day
         24    
      
      
         Last Week
         168
                    
      
         Last Month
         744              
                
      
    
        | dbquery mydb "select to_char(sysdate, 'YYYY-MM-DD HH24:MI:SS') current_ts, $pulldown_time_range$ pulldown_time_range_hours, to_char(sysdate-($pulldown_time_range$/24), 'YYYY-MM-DD HH24:MI:SS') pulldown_ts from dual"
       
          false
       
            
  


0 Karma

jjdorn
Explorer

Cool, glad to be of help. Sorry for the confusion with the capitalization. It looks right when I edit the text above, but then goes to all lower case when I come back to review the page.

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

Got it working. Thanks for all your help!

0 Karma

jjdorn
Explorer

AaronKorn, I do see a problem in the pasted syntax now that I look closer. For some reason the code tags are taking the capital "P" out of the "layoutPanel" tag and that will definately cause it to not work right since its case sensitive.

Change all of the "layoutpanel" text to be "layoutPanel" and try it again as a view.

0 Karma

jjdorn
Explorer

Are you creating a "dashboard" or a "view"?

This XML will only work in a view. If you try pasting it into a dashboard and then save it all you will get is a blank screen because the syntax is not simple-XML formatted.

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

Still nothing. Even when I copy this xml straight to a new blank dashboard nothing appears.

0 Karma

jjdorn
Explorer

First question would be, do you have the SideView Utils app installed?

If not that's probably the root issue since the Pulldown tag is sideview specific.

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

yes it is installed.

0 Karma

jjdorn
Explorer

Are you looking for a date range picker type solution, or a simple dropdown with some static time ranges?

I've used Sideview Utils to define some static dropdowns which pass parameters to searches with succcess using the an example snippet like the one below


...


dropdown_timerange
Time Range:


Last Day
24



Last Hour
1




Last Week
168



Last Month
744



<module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
      <param name="search">| dbquery yourdb "select * from your_table where (sysdate-time_field)*24 between 1 and $dropdown_timerange$ </param>
      <module name="SimpleResultsTable">
        <param name="displayRowNumbers">false</param>
      </module>
 </module

...

aaronkorn
Splunk Employee
Splunk Employee

So I tried adding this to the advanced xml and got:

Misconfigured view 'ESM_Test' - layoutPanel is not defined for module Pulldown

Misconfigured view 'ESM_Test' - layoutPanel is not defined for module SideviewUtils

found an invalid value for layoutPanel - 'None'

Any ideas?

0 Karma

jjdorn
Explorer

Unfortunately I think Sideview is only usable in Advanced-XML, but perhaps someone else has a way of accomplishing the same task with native functionality in Simple-XML.

If your dashboard isn't overly complex I'd really recommend taking the leap to the advanced XML code though. Most stuff translates pretty easily, and while it is slightly more complicated you also gain quite a bit of flexibility as to what tools you have at your disposal, and how they can be utilized.

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

Thanks for the feedback. Is there a way to do this in the simplified xml view?

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...