How to create a dashboard to display report1, report2, or an error message based on the time range selected by a user?

[spammenot66]

In the Splunk dashboard, I would like to add a logic that displays report1, report2, or generate an error based on the time range that a user has selected. If the user has selected a time range (range min and max) that is less than the specified date, then show report1. If time range (range min and max) are both more than the specified date, then show report2, otherwise show an error message.

In the dashboard, here's my code:

 <fieldset submitButton="false">
    <input type="time" token="maintime" searchWhenChanged="true">
      <label>Select Date/Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>   </fieldset>   <search id="Report_SelectedTimePeriod">
    <!-- logic to determine whether to query and filter by old method (1),new method (2), or error (3)  -->     <query>|gentimes start=-1 | addinfo | convert ctime(*) | eval reportDate_min=strptime(info_min_time,"%m/%d/%Y %H:%M:%S")| eval reportDate_max=strptime(info_max_time,"%m/%d/%Y %H:%M:%S")| eval comparedate=strptime("05/17/2016 12:00:00","%m/%d/%Y %H:%M:%S")|eval reportType=case(comparedate>reportDate_min AND comparedate>reportDate_max, 1, reportDate_min>comparedate  AND reportDate_max>comparedate, 2, 1=1,3)|table reportType</query>

<done>
       <condition match=" 'result.reportType' == 1">
            <set token="reporttype">Old Report
--$result.reportType$</set>
        </condition>
        <condition match=" 'result.reportType' == 2">
            <set token="reporttype">New Report</set>
        </condition>        <condition>
            <set token="show_html">Please ensure both, (the start and end Date) is More OR Less than 05/17/2016 12:00:00
--$job.resultCount$ </set>
        </condition>
    </done>
       </search>
     <row>
    <panel>
      <title>$reporttype_html$</title>
      <single>
        <title>$reporttype_html$</title>
        <search base="Report_SelectedTimePeriod">     

          <earliest>$maintime.earliest$</earliest>
          <latest>$maintime.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="beforeLabel">Report Date:</option>
        <option name="linkView">search</option>
        <option name="afterLabel">.</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="numberPrecision">0</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>   </row>   

[woodcock]

First, I would save each search as a saved search including the error one which would have a search like this:

|noop|stats count as ERROR|eval ERROR="This search always generates this error string!"

Now that you have 3 saved searches: Report1, Report2, and Error, use a subsearch like this:

| savedsearch [| noop | stats count AS add_info | add_info | eval duration=info_max_time - info_min_time | eval savedsearch=case((duration<xxx), "Report1", (duration<yyy), "Report2", true(), "Error") | return $savedsearch]

[spammenot66]

Thanks woodcock. its not exactly the solution i had in mind. i was able to resolve by changing the condition to be based on finalized instead of done. The next change was ensuring the result.field condition is compared to a string value rather than an integer. The string needed to be encased in html quotes as.

<finalized>
  <condition match=" 'result.reportType' == &quot;1&quot;">
             <set token="reporttype">Old Report
 --$result.reportType$
         </condition>
         <condition match=" 'result.reportType' == &quot;2&quot;">
             <set token="reporttype">New Report</set>
         </condition>         <condition>
             <set token="show_html">Please ensure both, (the start and end Date) is More OR Less than 05/17/2016 12:00:00
 --$job.resultCount$ 
         </condition>
</finalized>