Dashboards & Visualizations

How to create a dynamic drop-down on your own time field ?

akchauhan
Explorer

I have a field in logs (PublishTime) which is different from _time. To display the same in splunk I have created a dropdown that shows the time [snip #1]. However, I want the dropdwon similar to what we have for _time [snip #2]. Is there any way to achieve below?

alt text

alt text

Tags (1)
0 Karma

micahkemp
Champion

Things get trick when trying to use a timepicker for anything other than _time. Does your event actually have two legitimate timestamps (event time and PublishTime), or should PublishTime be the time of the event instead? If the latter, consider working to get that fixed at index time.

But to answer the actual question posted, you can do some gross things with searches that set tokens (epoch time for earliest/latest) based on other tokens (timepicker), and use the former in your search later. Here is a run anywhere example of this in action:

<form>
  <label>610251</label>
  <fieldset submitButton="false">
    <input type="time" token="timepicker">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <search id="set_earliest_latest_epoch">
    <query>| makeresults | addinfo | eval earliest_tok=info_min_time, latest_search=if(info_max_time="+Infinity", "", "PublishTime<".info_max_time)</query>
    <earliest>$timepicker.earliest$</earliest>
    <latest>$timepicker.latest$</latest>
    <done>
      <condition match="'job.resultCount' == 1">
        <set token="earliest_tok">$result.earliest_tok$</set>
        <set token="latest_search_tok">$result.latest_search$</set>
      </condition>
    </done>
  </search>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | eval PublishTime=relative_time(_time, "-5min") | search PublishTime>=$earliest_tok$ $latest_search_tok$ | stats count</query>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count</query>
          <earliest>$timepicker.earliest$</earliest>
          <latest>$timepicker.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...