How to add "Latest" keyword in the reporting day d...

sai_krishna · ‎04-29-2023

I want to add the "Latest" keyword to my drop down filter instead of date which displays the latest data.

Below is my source code:

<input type="dropdown" token="reportingDayA">
      <label>Reporting Day Misra apu</label>
      <fieldForLabel>readableDateA</fieldForLabel>
      <fieldForValue>epochA</fieldForValue>
      <search>
        <done>
          <set token="reportingDayDefA">$result.epochA$</set>
        </done>
        <query>index=`std_getAttrIndexBaseName`_qac$oem$ sourcetype=qac Variant="apu $Variant$"  Release=$release$ 
| dedup _time|  eval readableDateA=strftime(_time,"%F") 
| eval epochA=strftime(_time,"%s") | dedup readableDateA 
| sort - _time</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <default>$reportingDayDefA$</default>
    </input>

and Latest keyword should be default value to be selected

danspav · ‎06-04-2023

Hi @sai_krishna,

Try this:

 <fieldset submitButton="false">
    <input type="dropdown" token="reportingDayA">
      <label>Reporting Day Misra apu</label>
      <fieldForLabel>readableDateA</fieldForLabel>
      <fieldForValue>epochA</fieldForValue>
      <search>
        <query>| tstats count where index=_internal by _time span=1d
| eval readableDateA=strftime(_time,"%F") 
| eval epochA=strftime(_time,"%s") | dedup readableDateA 
| sort - _time
``` get latest and call it "latest" ```
| eventstats max(epochA) as latest
| eval readableDateA=if(epochA=latest,"Latest",readableDateA)
</query>
        <earliest>-7d@d</earliest>
        <latest>now</latest>
      </search>
       <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>

The search will get all the dates, and label the most recent one "Latest".

Due to the way the list is sorted, this entry is the first one in the list.

We can use that to our advantage by using the selectFirstChoice option for the dropdown - that makes the
first entry in the list selected.

Here it is in a dashboard:

<form version="1.1" theme="light">
  <label>Answers</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="reportingDayA">
      <label>Reporting Day Misra apu</label>
      <fieldForLabel>readableDateA</fieldForLabel>
      <fieldForValue>epochA</fieldForValue>
      <search>
        <query>| tstats count where index=_internal by _time span=1d
| eval readableDateA=strftime(_time,"%F") 
| eval epochA=strftime(_time,"%s") | dedup readableDateA 
| sort - _time
| eventstats max(epochA) as latest
| eval readableDateA=if(epochA=latest,"Latest",readableDateA)
</query>
        <earliest>-7d@d</earliest>
        <latest>now</latest>
      </search>
       <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
  <row>
  <html>
    <h1>You selected: $reportingDayA$</h1>
  </html>
  </row>
</form>

Cheers,
Daniel

How to add "Latest" keyword in the reporting day dropdown?

chart

dashboard

drilldown

panel

token

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Are you a member of the Splunk Community?

How to add "Latest" keyword in the reporting day dropdown?