Dashboards & Visualizations

Enable or disable drilldown based on time range

sanjeev543
Communicator

Hi,

Is it possible to apply the drill down only when the selected time rage is met?
For example, I would like to enable the drill down only if I am selecting more than 7 days ago to in dashboard

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sanjeev543

Can you please try this? I have used search for getting count from search with particular condition. You can find it in below XML.

<form>
  <label>Test </label>
  <search>
    <query>
      | makeresults | addinfo | eval diff=info_max_time - info_min_time, day=round(diff/60/60/24,0) | where day>=7 
    </query>
    <earliest>$earliest$</earliest>
    <latest>$latest$</latest>
    <done>
      <set token="jobcount">$job.resultCount$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time">
      <label></label>
      <default>
        <earliest>-48h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$jobcount$ $drilldown_called$</title>
      <table>
        <search>
          <query> | makeresults | addinfo | eval diff=info_max_time - info_min_time, day=round(diff/60/60/24,0) </query>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <condition match="$jobcount$ != &quot;0&quot;">
            <set token="drilldown_called">True</set>
            <!-- KEEP DRILLDOWN LOGC HERE -->
          </condition>
          <condition>
            <unset token="drilldown_called"></unset>
            <!-- SKIP DRILL DOWN BY KEEPING BLANK -->
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@sanjeev543

Can you please try this? I have used search for getting count from search with particular condition. You can find it in below XML.

<form>
  <label>Test </label>
  <search>
    <query>
      | makeresults | addinfo | eval diff=info_max_time - info_min_time, day=round(diff/60/60/24,0) | where day>=7 
    </query>
    <earliest>$earliest$</earliest>
    <latest>$latest$</latest>
    <done>
      <set token="jobcount">$job.resultCount$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="time">
      <label></label>
      <default>
        <earliest>-48h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$jobcount$ $drilldown_called$</title>
      <table>
        <search>
          <query> | makeresults | addinfo | eval diff=info_max_time - info_min_time, day=round(diff/60/60/24,0) </query>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <condition match="$jobcount$ != &quot;0&quot;">
            <set token="drilldown_called">True</set>
            <!-- KEEP DRILLDOWN LOGC HERE -->
          </condition>
          <condition>
            <unset token="drilldown_called"></unset>
            <!-- SKIP DRILL DOWN BY KEEPING BLANK -->
          </condition>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

Thanks

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...