Dashboards & Visualizations

How to dynamically set trendInterval option of a Single Value visualization equal to a Time input's range?

bschaap
Path Finder

Does anyone know how to dynamically set the trendInterval option of a Single Value visualization equal to a time interval specified in a Time input?

I believe I need to set the value equal to a token like below but am unsure how to set $mytoken$ equal to a time interval based on the range chosen in a Time input. However, I can't seem to get it to work.

<input type="time" token="tf">
  <change>
    <eval token="days">round(($tf.earliest$ - $tf.latest$)/86400,0)</eval>
  </change>
  <label></label>
  <default>
    <earliest>-4h@m</earliest>
    <latest>now</latest>
  </default>
</input>

...
&ltsingle&gt
...
&ltoption name="trendInterval"&gt$days$d&lt/option&gt
...
&lt/single&gt

Tags (1)
0 Karma

jtafese
New Member

The scenario you've described can be solved using this work around, if your dashboard is not too big. If the time for the trendInterval is from a finite set, then you can have different panels for each trendInterval, and toggle their appearance by the use of tokens that can be set and unset. For example, if the time intervals you are interested in are 24hr and 1week, you can do the following:

<input type="dropdown" token="time_span" searchWhenChanged="true">
  ...
  <choice value="24hr">24 Hour</choice>
  <choice value="1w">7 Days</choice>
  ...
  <change>
    <condition value="24hr">
      <unset token="1w_token"></unset>
      <set token="24hr_token"></set>
    </condition>
    <condition value="1w">
      <unset token="24hr_token"></unset>
      <set token="1w_token"></set>
    </condition>
  </change>
</input>

With that in place, you can use:

<panel depends="$24hr_token$, $other_tokens...$">
   ...
   <single>
    <option name="trendInterval">-24hr</option>
  </single>
  ...
</panel>

And similarly for the 7 day time interval.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...