Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to pass lookup field values to the time range?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to pass lookup field values to the time range?
Hello,
I have a lookup file which has fields Month, earliest, latest. I have drop down name "Month" which gives me the list of all the months from the lookup table. When I choose a month from the drop down the respective values of the earliest and the latest should be passed to the searches or time range token in the dashboard.
Month earliest latest
Jan 01/15/2020:03:34:45 01/15/2020:05:34:45
Feb 02/15/2020:03:34:45 02/15/2020:01:34:45
Mar 03/15/2020:03:34:45 03/15/2020:07:34"45
Apr 04/15/2020:03:34:45 04/15/2020:08:34:45
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SAMPLE:
<form>
<label>lookup to time</label>
<fieldset submitButton="false">
<input type="dropdown" token="timepicker" searchWhenChanged="true">
<label>time piker</label>
<fieldForLabel>Month</fieldForLabel>
<fieldForValue>query</fieldForValue>
<search>
<query>| makeresults
| eval _raw="Month earliest latest
Jan 01/15/2020:03:34:45 01/15/2020:05:34:45
Feb 02/15/2020:03:34:45 02/15/2020:01:34:45
Mar 03/15/2020:03:34:45 03/15/2020:07:34:45
Apr 04/15/2020:03:34:45 04/15/2020:08:34:45"
| multikv forceheader=1
| table Month earliest latest
| foreach *est [ eval <<FIELD>> = round(strptime(<<FIELD>>,"%m/%d/%Y:%T"))]
| eval query="(earliest=".earliest." "."latest=".latest.")"</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
</fieldset>
<row>
<panel>
<html>token value: $timepicker$</html>
</panel>
</row>
<row>
<panel>
<event>
<search>
<query>index=_internal $timepicker$</query>
<earliest>0</earliest>
<latest></latest>
</search>
<option name="list.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</event>
</panel>
</row>
</form>
recommend:
<input type="dropdown" token="timepicker" searchWhenChanged="true">
<label>time piker</label>
<fieldForLabel>Month</fieldForLabel>
<fieldForValue>query</fieldForValue>
<search>
<query>| inputlookup your_csv
| foreach *est [ eval <<FIELD>> = round(strptime(<<FIELD>>,"%m/%d/%Y:%T"))]
| eval query="(earliest=".earliest." "."latest=".latest.")"</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
please put the token $timepicker$ to your main search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just thought of sharing this. If date time values are in timeformat %m/%d/%Y:%H:%M:%S, then you can search earliest and latest with them directly. So below query also works.
index=_internal earliest="02/21/2020:05:00:00" latest="02/21/2020:05:05:00"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@manjunathmeti , yes.
| inputlookup your_csv
| eval query="(earliest=".earliest." "."latest=".latest.")"
It's OK.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@to4kawa Thank you! It worked..
But I wanted to use the result of the query to change the token using eval. But it's not working.
I need to check a specific value of the earliest from the result. If it matches then I need to use the token and assign some other value to it.
The token value is not getting effected in the panel. Can you help me on this?
<input type="dropdown" token="timepicker" searchWhenChanged="true">
<label>time piker</label>
<fieldForLabel>Month</fieldForLabel>
<fieldForValue>query</fieldForValue>
<search>
<query>| inputlookup sample_file
| foreach *est [ eval <<FIELD>> = round(strptime(<<FIELD>>,"%m/%d/%Y:%T"))]
| eval query="(earliest=".earliest." "."latest=".latest.")"
<earliest>0</earliest>
<latest></latest>
</search>
<change>
<eval token="abc">if('query.earliest'= 1577817000, (earliest=1577817000 latest=15777903400), (earliest=1577817000 latest=15777903405))</eval>
</change>
</input>
<panel>
<html>token value: $timepicker$ $abc$</html>
</panel>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
<change>
<eval token="abc">if(mvindex(split($timepicker$,"="),1) = 1577817000,"(earliest=1577817000 latest=1577903400)", "(earliest=1577817000 latest=1577903405)")</eval>
</change>
query.earliest is nothing.
Fun with Regular Expression - multiples of nine
[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...
What’s New & Next in Splunk SOAR
