Dashboards & Visualizations

Drilldown with dynamic relative_time

Micke
Observer

I am trying to drilldown within a dashboard. I wish set a token-value with relative_time, using a dynamic relative time specifier input-variable.

If I set the relative time specifier to "+1h" it works fine: <eval token="endTime_token">relative_time($startTime_token$, "+1h")</eval>

But when I use a token with value "1h" it does not: <eval token="endTime_token2">relative_time($startTime_token$, "+$resultion_token$"</eval>

I paste my complete code as reference:

 

 

<form>
<label>Drilldown-lab</label>
<fieldset submitButton="false">
    <input type="time" token="period_token">
      <label>Period</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>@h</latest>
      </default>
    </input>
    <input type="dropdown" token="resolution_token">
      <label>Resolution</label>
      <choice value="15m">15 minutes</choice>
      <choice value="1h">1 hour</choice>
      <default>1h</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Overview-panel</title>
      <table>
        <search>
          <query>
            index="my_index"
            | bin _time span=$resolution_token$
            | eval startTime = strftime(_time, "%Y-%m-%d %H:%M")
            | stats count by startTime
            </query>
          <earliest>$period_token.earliest$</earliest>
          <latest>$period_token.latest$</latest>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <eval token="startTime_token">strptime($row.startTime$, "%Y-%m-%d %H:%M")</eval>
          <eval token="endTime_token">relative_time($startTime_token$, "+1h")</eval>
          <eval token="endTime_token2">relative_time($startTime_token$, "+$resultion_token$"</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$startTime_token$">
      <title>Drilldown-panel $endTime_token$, $endTime_token2$</title>
      <table>
        <search>
          <query>
            index="my_index"
            | stats avg(responseTimeMs) as Responsetime_avg count by assetId
          </query>
          <earliest>$startTime_token$</earliest>
          <latest>$endTime_token$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

 

 

 

 I am able to calculate the endTime-value in my query (SPL), I would prefer to be able to set it with "eval token".

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Apart from fixing the typo, try this

<eval token="endTime_token2">relative_time($startTime_token$, "+".$resolution_token$</eval>
0 Karma

Micke
Observer

Works perfect, thank you (and also for pointing out the typo)!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...