Dashboards & Visualizations

Drilldown with dynamic relative_time

Micke
Observer

I am trying to drilldown within a dashboard. I wish set a token-value with relative_time, using a dynamic relative time specifier input-variable.

If I set the relative time specifier to "+1h" it works fine: <eval token="endTime_token">relative_time($startTime_token$, "+1h")</eval>

But when I use a token with value "1h" it does not: <eval token="endTime_token2">relative_time($startTime_token$, "+$resultion_token$"</eval>

I paste my complete code as reference:

 

 

<form>
<label>Drilldown-lab</label>
<fieldset submitButton="false">
    <input type="time" token="period_token">
      <label>Period</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>@h</latest>
      </default>
    </input>
    <input type="dropdown" token="resolution_token">
      <label>Resolution</label>
      <choice value="15m">15 minutes</choice>
      <choice value="1h">1 hour</choice>
      <default>1h</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Overview-panel</title>
      <table>
        <search>
          <query>
            index="my_index"
            | bin _time span=$resolution_token$
            | eval startTime = strftime(_time, "%Y-%m-%d %H:%M")
            | stats count by startTime
            </query>
          <earliest>$period_token.earliest$</earliest>
          <latest>$period_token.latest$</latest>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <eval token="startTime_token">strptime($row.startTime$, "%Y-%m-%d %H:%M")</eval>
          <eval token="endTime_token">relative_time($startTime_token$, "+1h")</eval>
          <eval token="endTime_token2">relative_time($startTime_token$, "+$resultion_token$"</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$startTime_token$">
      <title>Drilldown-panel $endTime_token$, $endTime_token2$</title>
      <table>
        <search>
          <query>
            index="my_index"
            | stats avg(responseTimeMs) as Responsetime_avg count by assetId
          </query>
          <earliest>$startTime_token$</earliest>
          <latest>$endTime_token$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

 

 

 

 I am able to calculate the endTime-value in my query (SPL), I would prefer to be able to set it with "eval token".

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Apart from fixing the typo, try this

<eval token="endTime_token2">relative_time($startTime_token$, "+".$resolution_token$</eval>
0 Karma

Micke
Observer

Works perfect, thank you (and also for pointing out the typo)!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...