I am trying to create a dashboard which I can show different dashboards in one by changing the date range and other parameters. Everything is working fine, but there is one problem am trying to solve. The problem is I want to have a default date of Today's date (for the End Date) and 30 days before today's date (for starting Date). My dashboard is calling a stored procedure in the database and it has three parameters to run successfully. Here is part of my XML:
So, how can I set up the EndDate to be Today's date and the StartDate to be 30 days before today's date??
Any help or suggestion is appreciated
I am not aware of any option to assign dynamic value to input of type text. One workaround could be to convert these text input to dropdown input and run a query to get the values. That way it would be dynamic and you can control the format. An example would be like this. [In Splunk 5.x, the value should be selected by default in the dropdown. In Splunk 6.0, it will not select any value and user would have to select a value. In Splunk 6.0.1 onwards, you would have to add
<selectFirstChoice>true</selectFirstChoice> to the dropdown inputs to select the value by default.
<form> <label>Test</label> <fieldset> <input type="dropdown" token="startdate"> <label>StartDate</label> <populatingSearch fieldForValue="startdate" fieldForLabel="startdate"> <![CDATA[|stats count | eval startdate=strftime(now(),"%m/%d/%Y") | table startdate ]]> </populatingSearch> </input> <input type="dropdown" token="enddate"> <label>EndDate</label> <populatingSearch fieldForValue="enddate" fieldForLabel="enddate"> <![CDATA[|stats count | eval enddate=strftime(relative_time(now(),"-30d"),"%m/%d/%Y") | table enddate ]]> </populatingSearch> </input> </fieldset> <row> <table> <searchString>index=_internal | stats count by sourcetype</searchString> <earliestTime>-5m@m</earliestTime> </table> </row> </form>