Dashboards & Visualizations

Help with Creating a Dynamic Dropdown for Months and Year

Communicator

I'm trying to create dropdown menus, one for the Month and another for the Year, that use dynamic options and timepicker 'today' to default to Current Month and Current Year. I have tested that part successfully.

My question is I'm looking to fill the rest of my dropdown menus 'Month' and 'Year' with previous months and years so I can also search historical data. I have been testing using output lookup tables but I don't have a lot of experience using that option and hoping the community has a few possible options to try out.

Testing query :

index=* 
| eval Time=strftime(_time, "%m/%d/%Y %I:%M:%S %p")
| rex field=Time "(?<date_month>\d+)/"
| rex field=Time "(?<date_year>\d{4})"
| dedup date_month
| dedup date_year
| table date_month, date_year
| output date_lookup
0 Karma
1 Solution

Champion

Try this!

| dedup date_month
| dedup date_year

| dedup date_month,date_year

View solution in original post

0 Karma

Champion

Try this!

| dedup date_month
| dedup date_year

| dedup date_month,date_year

View solution in original post

0 Karma

Communicator

Thanks @HiroshiSatoh Have you worked with populating dropdown menus dynamically or with lookups before?

0 Karma

Champion

It is a sample dynamically setting a dropdown from the event log.

<input type="dropdown" token="yyyymm">
    <label>Target Month</label>
    <populatingSearch fieldForValue="trng" fieldForLabel="yyyymm">
         <![CDATA[source="WinEventLog:System" (EventCode=6005 OR EventCode=6006) | table _time | eval yyyymm=strftime(_time,"%m/%Y")|dedup yyyymm| eval sdate=substr(yyyymm,1,2)+"/01/"+substr(yyyymm,4,4)+":0:0:0" | eval edate=strftime(relative_time(strptime(sdate,"%m/%d/%Y:%H:%M:%S"),"+1month"),"%m/%d/%Y:%H:%M:%S")  |  eval trng="earliest="+sdate+" latest="+edate]]>
    </populatingSearch>
</input>
0 Karma