Dashboards & Visualizations

Drilldown with dynamic relative_time

Micke
Observer

I am trying to drilldown within a dashboard. I wish set a token-value with relative_time, using a dynamic relative time specifier input-variable.

If I set the relative time specifier to "+1h" it works fine: <eval token="endTime_token">relative_time($startTime_token$, "+1h")</eval>

But when I use a token with value "1h" it does not: <eval token="endTime_token2">relative_time($startTime_token$, "+$resultion_token$"</eval>

I paste my complete code as reference:

 

 

<form>
<label>Drilldown-lab</label>
<fieldset submitButton="false">
    <input type="time" token="period_token">
      <label>Period</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>@h</latest>
      </default>
    </input>
    <input type="dropdown" token="resolution_token">
      <label>Resolution</label>
      <choice value="15m">15 minutes</choice>
      <choice value="1h">1 hour</choice>
      <default>1h</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Overview-panel</title>
      <table>
        <search>
          <query>
            index="my_index"
            | bin _time span=$resolution_token$
            | eval startTime = strftime(_time, "%Y-%m-%d %H:%M")
            | stats count by startTime
            </query>
          <earliest>$period_token.earliest$</earliest>
          <latest>$period_token.latest$</latest>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <eval token="startTime_token">strptime($row.startTime$, "%Y-%m-%d %H:%M")</eval>
          <eval token="endTime_token">relative_time($startTime_token$, "+1h")</eval>
          <eval token="endTime_token2">relative_time($startTime_token$, "+$resultion_token$"</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$startTime_token$">
      <title>Drilldown-panel $endTime_token$, $endTime_token2$</title>
      <table>
        <search>
          <query>
            index="my_index"
            | stats avg(responseTimeMs) as Responsetime_avg count by assetId
          </query>
          <earliest>$startTime_token$</earliest>
          <latest>$endTime_token$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

 

 

 

 I am able to calculate the endTime-value in my query (SPL), I would prefer to be able to set it with "eval token".

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Apart from fixing the typo, try this

<eval token="endTime_token2">relative_time($startTime_token$, "+".$resolution_token$</eval>
0 Karma

Micke
Observer

Works perfect, thank you (and also for pointing out the typo)!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...