Conditional Dropdown based on date

[nareshinsvu]

Hello experts,

I have 2 dropdowns in my dashboard.

1st - Last 7 days (including TODAY)
2nd - If I select TODAY in 1st, I need to write a search query on an index to populate values in this dropdown.
If I select any other day, I need to search inputlookup csv file which gets generated everyday at 00:02 (having all the values of last 6 days).

How can I put this if-else condition to populate 2nd dropdown?

Thanks,
Naresh

[nareshinsvu · Accepted solution]

It's resolved. Instead of getting $todate$ from outside,

I tried to create new column with today's date in the 2nd dropdown query.

And Set it to a token and used it to compare in the conditions. it worked.

[paramagurukarth]

User condition statement with on-change event for your dropdown1 and form the search for your dropdown two

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field0">
      <label>field0</label>
      <showClearButton>0</showClearButton>
      <choice value="today">Today</choice>
      <choice value="Day2">Day 2</choice>
      <default>today</default>
      <change>
        <condition label="Today">
          <set token="search_for_field1">|rest /services/data/indexes | table coldPath | rename coldPath as title</set>
        </condition>
        <condition label="Day 2">
          <set token="search_for_field1">|rest /services/data/indexes | table title</set>          
        </condition>
      </change>
    </input>
    <input type="dropdown" token="field1">
      <search>
        <query>$search_for_field1$</query>
      </search>
      <fieldForLabel>title</fieldForLabel>
      <fieldForValue>title</fieldForValue>
    </input>
  </fieldset>
</form>

[nareshinsvu]

Hi @paramagurukarthikeyan

It's a nice idea to write queries during the condition matches. But my Today is not a static value. Below is my code snippet. Somehow my condition is not able to give me results when I use $todate$. I hope it's a minor tweak. Need help please.

Below I am setting token $todate$ to today's value

      <query>| makeresults|eval today=strftime(_time,"%Y-%m-%d")|fields - _time</query>
 <done>
   <set token="todate">$result.today$</set>
 </done>

And using it in below code snippet. My default value is

  <input type="dropdown" token="selected_date" searchWhenChanged="true">
  <label>Select a Date</label>
  <default>$todate$</default>

.
.
.
.


| inputlookup lookup.csv | search Day=$selected_date$ | stats count by TRAN_CAT

[nareshinsvu]

New updates:

I am able to make it work. But new problem. Only first condition works. 2nd condition is not working.

    <condition match="$value$!=&quot;$todate$&quot;">
      <unset token="selected_T_query"></unset>
      <set token="selected_T_query">
       | inputlookup  lookup.csv | search Day=$selected_date$ | stats count by TRAN_CAT
      </set>
    </condition >

    <condition  >
      <unset token="selected_T_query"></unset>
      <set token="selected_T_query">
      | savedsearch 00Dashboard_All_Lookup  |  stats count by TRAN_CAT 
      </set>
    </condition >
      </change>

[paramagurukarth]

<condition> is like simple if-else,
your second <condition> is not containing any rules

if your first <condition> is

  <condition match="$value$!=$todate$">

then your second <condition> should be,

 <condition match="$value$==$todate$">

[nareshinsvu]

@paramagurukarthikeyan - It didn't help me Mate after making changes to condition2 as you suggested. @niketnilay was right. All my condition matches are going to 1st condition

[paramagurukarth]

May be Splunk is not processing the token string $insideDollor$ in a token string.. in that case try adding a JavaScript . In that listen for the value change in the fisrt field token and form the search string based on your value..

Refer here http://dev.splunk.com/view/SP-CAAAEW4

[niketn]

@nareshinsvu @paramagurukarthikeyan else condition need not have explicit match condition.

If in the above case default condition block is not getting hit that implies $value$!="$todate$" is always true i.e. Selected value token is never equal to todate token. Print in the dashboard to confirm the values.

Add the following code to both condition blocks and display in Dashboard using panel title or something else:

<set token="selectedTokenValue">$value$</set>

[nareshinsvu]

Hi @niketnilay

You are right. My default condition is never hit. I tried to display the values in my dashboard. Result is shown below

1st Condition value is 20190411 and default condition value is $selectedTokenValue1$ and Today is 20190411

My default condition should pick the value if it is same as $todate$. But it is not hitting as it is read by my 1st condition. How can I avoid this in condition 1?

[nareshinsvu]

It works when I hardcode like below. But I need it dynamic which changes on daily basis

[nareshinsvu]

condition match="$value$!="2019-04-11""