How to add dropdown for time(only for last24hr,last7days,last30days and last 6 months) in dashboard.

[ajitshukla]

I am new to splunk ,please help me to achieve this task .
In My dashboard I have added time range picker and It's working fine ,But Now I want to provide only four option to user for time.
my base search is here

<search id="base_search">
    <query>index="testinput"|table Latitude,Longitude,Timestamp</query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
  </search>

and Dropdown for Time

 <input type="time" token="time" searchWhenChanged="true">
      <label>TIME</label>
      <default>
        <earliest>0</earliest>
        <latest></latest>
      </default>
    </input>

[vnravikumar · Accepted solution]

Hi @ajitshukla

I hope, the following code will help you

<form>
  <label>Date_dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>field1</label>
      <choice value="last24">Last 24 Hours</choice>
      <choice value="last7">Last 7 Days</choice>
      <choice value="last30">Last 30 Days</choice>
      <choice value="last6">Last 6 Months</choice>
      <change>
        <condition label="Last 24 Hours">
          <set token="custom_earliest">-24h@h</set>
          <set token="custom_latest">now</set>
        </condition>
        <condition label="Last 7 Days">
          <set token="custom_earliest">-7d@h</set>
          <set token="custom_latest">now</set>
        </condition>
        <condition label="Last 30 Days">
          <set token="custom_earliest">-30d@d</set>
          <set token="custom_latest">now</set>
        </condition>
        <condition label="Last 6 Months">
          <set token="custom_earliest">6mon@mon</set>
          <set token="custom_latest">@mon</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal"|dedup _time | table _time</query>
          <earliest>$custom_earliest$</earliest>
          <latest>$custom_latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

[ajitshukla]

thank you so much its working fine !!
just one update is required
<set token="custom_earliest">-6mon@mon</set>
<set token="custom_latest">@mon</set>
I know it's minute but still for correct code.

[kamlesh_vaghela]

@ajitshukla

Please refer below links:

https://simonduff.net/splunk_restrict_time_range_picker/
https://answers.splunk.com/answers/222650/limit-choices-in-default-timepicker.html

Thanks

[dkeck]

HI,

this is not a dropdown but radio buttons, but you could do something like this:

What you do is to set condition based on the label defined by <choice>
Within each <condition> , specify a custom label for display
Capture the selected value in the token, earliest_tok

<dashboard>
          <label> Name </label>
          <description></description>
          <fieldset submitButton="true">
            <input type="radio" token="period_tok">
              <label>Select a time range</label>
              <choice value="-4h@h">Last 4 Hours</choice>
              <choice value="-24h@h">Last 24 Hours</choice>
              <choice value="-7d@h">Last 7 Days</choice>
              <choice value="-30d@h">Last 30 Days</choice>
              <choice value="-365d@h">Last 365 Days</choice>
              <default>Last 24 Hours</default>
              <!-- set condition based on the label defined by <choice> -->
              <!-- Within each condition, specify a custom label for display -->
              <!-- Capture the selected value in the token, earliest_tok -->
              <change>
                  <condition label="Last 4 Hours">
                  <set token="date_label">Last 4h</set>
                  <set token="earliest_tok">$value$</set>
                  <set token="spanTime">"2m"</set>
                </condition>
                <condition label="Last 24 Hours">
                  <set token="date_label">Yesterday</set>
                  <set token="earliest_tok">$value$</set>
                  <set token="spanTime">"20m"</set>
                </condition>
                <condition label="Last 7 Days">
                  <set token="date_label">Last week</set>
                  <set token="earliest_tok">$value$</set>
                  <set token="spanTime">"4h"</set>
                </condition>
                <condition label="Last 30 Days">
                  <set token="date_label">Last month</set>
                  <set token="earliest_tok">$value$</set>
                  <set token="spanTime">"12h"</set>
                </condition>
                <condition label="Last 365 Days">
                  <set token="date_label">Last year</set>
                  <set token="earliest_tok">$value$</set>
                  <set token="spanTime">"1d"</set>
                </condition>
              </change>
            </input>
    <row>
        <panel>
          <title>Name $date_label$</title>
          <chart>
            <search>
              <query> your search</query>
              <earliest>$earliest_tok$</earliest>
              <latest>now</latest>
              <sampleRatio>1</sampleRatio>
            </search>
          </chart>
        </panel>
      </row>
    </dashboard>

[dkeck]

Did this work for you ?

if it helped please accept the question 🙂

[ajitshukla]

hey thanks for this ,@vnravikumar
code's working fine for me so I haven't try this.