Dashboards & Visualizations

How to change the group by clause in timechart command depending on selected value in drop-down?

praspai
Path Finder

I want to change the group by clause in search command depending upon selected value in drop-down box in dashboard

e.g. Selected value is "All" then group by clause should look like timechart sum(x) group by host
else
Selected value is "Environment" then group by clause should look like timechart sum(x) group by environment

Thanks,
Prashant

0 Karma
1 Solution

rjthibod
Champion

You can easily do this with the <change> option on your input dropdown.

    <input id="split_field" searchWhenChanged="true" token="split_field" type="dropdown">
      <label>Split-by Field</label>
      <choice value="all">All</choice>
      ...
      <choice value="env">Environment</choice>
      <default>all</default>
      <change>
        <condition label="All">
          <set token="split_field_opt">host</set>
        </condition>
       ...
        <condition label="Environment">
          <set token="split_field_opt">environment</set>
        </condition>        
      </change>
    </input>
    ...
    <panel>
      <chart>
        <search><query>YOUR SEARCH | timechart sum(x) group by  $split_field_opt$</query></search>
      </chart>
    </panel>

View solution in original post

rjthibod
Champion

You can easily do this with the <change> option on your input dropdown.

    <input id="split_field" searchWhenChanged="true" token="split_field" type="dropdown">
      <label>Split-by Field</label>
      <choice value="all">All</choice>
      ...
      <choice value="env">Environment</choice>
      <default>all</default>
      <change>
        <condition label="All">
          <set token="split_field_opt">host</set>
        </condition>
       ...
        <condition label="Environment">
          <set token="split_field_opt">environment</set>
        </condition>        
      </change>
    </input>
    ...
    <panel>
      <chart>
        <search><query>YOUR SEARCH | timechart sum(x) group by  $split_field_opt$</query></search>
      </chart>
    </panel>
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...