Comparing data based on user-selected options from a dropdown menu.

[Gauri]

"I need to create a dashboard with two queries in one dashboard, one query having a fixed time range of "Today" and the other query needs to select "earliest and latest" from the drop down. The data dropdown will have two values "Yesterday" and "last week". Last week is the day from last week (if today is Feb 13, last week should show data from Feb Feb 06)"

for.eg 

index="abc" sourcetype="Prod_logs"
| stats count(transactionId) AS TotalRequest (***earliest and latest needs to be derived as per user selection from drop down)
| appendcols [search index="abc" sourcetype="Prod_logs" earliest=@d  latest=now (****Today's data****)
| stats count(transactionId) AS TotalRequest]

[ITWhisperer · Accepted solution]

Try something like this

    <input type="dropdown" token="timeperiod" searchWhenChanged="true">
      <label>Select day</label>
      <choice value="earliest=-1d@d latest=@d">Yesterday</choice>
      <choice value="earliest=-7d@d latest=-6d@d">Last week</choice>
    </input>

Then use the $timeperiod$ token in your first search

[gcusello]

Hi @Gauri ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[Gauri]

How can I get the complete date time format for both the queries in graph, 

for eg.

index="abc" sourcetype="Prod_logs"
| eval "yesterday_datetime_formatted" = strftime(_time,"%Y-%m-%d %H:%M:%S")
| stats count(transactionId) AS TotalRequest by yesterday_datetime_formatted URI (***earliest and latest needs to be derived as per user selection from drop down)
appendcols [search index="abc" sourcetype="Prod_logs" earliest=xxx, latest=now
| eval "Today_datetime_formatted" = strftime(_time,"%Y-%m-%d %H:%M:%S")
| stats count(transactionId) AS TotalRequest by Today_datetime_formatted URI]

| fields "yesterday_datetime_formatted"  "Today_datetime_formatted" 

[ITWhisperer]

Please give us a mock-up of what your desired output would look like

[Gauri]

Below query is what I am trying to execute, In the Statistics I am getting the data correctly with correct dates but in graph I am getting same date for both Yesterday & Today.

for.eg. Today is 14th and Yesterday is 13th,  I am getting the date 13th in Visualization for both the days.

index="abc" sourcetype="Prod_logs" (***earliest and latest needs to be derived as per user selection from drop down)
| eval "yesterday_datetime_formatted" = strftime(_time,"%Y-%m-%d %H:%M:%S")
| stats count(transactionId) AS TotalRequest by "yesterday_datetime_formatted" URI
| eval "Uptime SLI" = *****some formula*****,
"Latency SLI Yesterday" = *****some formula*****
appendcols [search index="abc" sourcetype="Prod_logs" earliest=@d, latest=now
| eval "Today_datetime_formatted" = strftime(_time,"%Y-%m-%d %H:%M:%S")
| stats count(transactionId) AS TotalRequest by "Today_datetime_formatted" URI
| eval "Uptime SLI" = *****some formula*****,
"Latency SLI Today" = *****some formula*****
]

| fields "today_datetime_formatted" "Latency SLI Today" "yesterday_datetime_formatted" "Latency SLI Yesterday"

[ITWhisperer]

Please give us a mock-up of what your desired output would look like

[gcusello]

Hi @Gauri,

in the dropdown list insert the following fixed choices:

earliest=-d@d
earliest=-w@w

then in the search use the dropdown token:

index="abc" sourcetype="Prod_logs" $token$ latest=now
| eval day=if(strftime(_time,"%Y-%m-%d")=strftime(now(),"%Y-%m-%d"),"Today","Previous")
| stats count(transactionId) AS TotalRequest BY day

Ciao.

Giuseppe