Dashboards & Visualizations

Conditional Dropdown based on date

nareshinsvu
Builder

Hello experts,

I have 2 dropdowns in my dashboard.

1st - Last 7 days (including TODAY)
2nd - If I select TODAY in 1st, I need to write a search query on an index to populate values in this dropdown.
If I select any other day, I need to search inputlookup csv file which gets generated everyday at 00:02 (having all the values of last 6 days).

How can I put this if-else condition to populate 2nd dropdown?

Thanks,
Naresh

Tags (1)
0 Karma
1 Solution

nareshinsvu
Builder

It's resolved. Instead of getting $todate$ from outside,

I tried to create new column with today's date in the 2nd dropdown query.

And Set it to a token and used it to compare in the conditions. it worked.

View solution in original post

0 Karma

nareshinsvu
Builder

It's resolved. Instead of getting $todate$ from outside,

I tried to create new column with today's date in the 2nd dropdown query.

And Set it to a token and used it to compare in the conditions. it worked.

0 Karma

paramagurukarth
Builder

User condition statement with on-change event for your dropdown1 and form the search for your dropdown two

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field0">
      <label>field0</label>
      <showClearButton>0</showClearButton>
      <choice value="today">Today</choice>
      <choice value="Day2">Day 2</choice>
      <default>today</default>
      <change>
        <condition label="Today">
          <set token="search_for_field1">|rest /services/data/indexes | table coldPath | rename coldPath as title</set>
        </condition>
        <condition label="Day 2">
          <set token="search_for_field1">|rest /services/data/indexes | table title</set>          
        </condition>
      </change>
    </input>
    <input type="dropdown" token="field1">
      <search>
        <query>$search_for_field1$</query>
      </search>
      <fieldForLabel>title</fieldForLabel>
      <fieldForValue>title</fieldForValue>
    </input>
  </fieldset>
</form>

nareshinsvu
Builder

Hi @paramagurukarthikeyan

It's a nice idea to write queries during the condition matches. But my Today is not a static value. Below is my code snippet. Somehow my condition is not able to give me results when I use $todate$. I hope it's a minor tweak. Need help please.

Below I am setting token $todate$ to today's value

      <query>| makeresults|eval today=strftime(_time,"%Y-%m-%d")|fields - _time</query>
 <done>
   <set token="todate">$result.today$</set>
 </done>

And using it in below code snippet. My default value is

  <input type="dropdown" token="selected_date" searchWhenChanged="true">
  <label>Select a Date</label>
  <default>$todate$</default>

.
.
.
.


| inputlookup lookup.csv | search Day=$selected_date$ | stats count by TRAN_CAT

0 Karma

nareshinsvu
Builder

New updates:

I am able to make it work. But new problem. Only first condition works. 2nd condition is not working.

    <condition match="$value$!=&quot;$todate$&quot;">
      <unset token="selected_T_query"></unset>
      <set token="selected_T_query">
       | inputlookup  lookup.csv | search Day=$selected_date$ | stats count by TRAN_CAT
      </set>
    </condition >

    <condition  >
      <unset token="selected_T_query"></unset>
      <set token="selected_T_query">
      | savedsearch 00Dashboard_All_Lookup  |  stats count by TRAN_CAT 
      </set>
    </condition >
      </change>
0 Karma

paramagurukarth
Builder

<condition> is like simple if-else,
your second <condition> is not containing any rules

if your first <condition> is

  <condition match="$value$!=$todate$">

then your second <condition> should be,

 <condition match="$value$==$todate$">
0 Karma

nareshinsvu
Builder

@paramagurukarthikeyan - It didn't help me Mate after making changes to condition2 as you suggested. @niketnilay was right. All my condition matches are going to 1st condition

0 Karma

paramagurukarth
Builder

May be Splunk is not processing the token string $insideDollor$ in a token string.. in that case try adding a JavaScript . In that listen for the value change in the fisrt field token and form the search string based on your value..

Refer here http://dev.splunk.com/view/SP-CAAAEW4

0 Karma

niketn
Legend

@nareshinsvu @paramagurukarthikeyan else condition need not have explicit match condition.

If in the above case default condition block is not getting hit that implies $value$!=&quot;$todate$&quot; is always true i.e. Selected value token is never equal to todate token. Print in the dashboard to confirm the values.

Add the following code to both condition blocks and display in Dashboard using panel title or something else:

<set token="selectedTokenValue">$value$</set>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nareshinsvu
Builder

Hi @niketnilay

You are right. My default condition is never hit. I tried to display the values in my dashboard. Result is shown below

1st Condition value is 20190411 and default condition value is $selectedTokenValue1$ and Today is 20190411

My default condition should pick the value if it is same as $todate$. But it is not hitting as it is read by my 1st condition. How can I avoid this in condition 1?

0 Karma

nareshinsvu
Builder

It works when I hardcode like below. But I need it dynamic which changes on daily basis

0 Karma

nareshinsvu
Builder

condition match="$value$!="2019-04-11""

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...