Dashboards & Visualizations

How to populate only available data in the Dashboard

aditsss
Builder

Hi Everyone,

I have one requirement.

I have multiple Dashboards with Time/Range dropdown in all the Dashboards.

As of now I have set it as last 7 days for all the Dashboards.

For one  dashboard the data is there  till 21st Feb

For second dashboard the data is there till 26th Feb

So as of now its showing  "NO RESULT FOUND"  since its set to last 7 days.

My requirement is it should populate data from last good date from when data is available .

Like for 1st Dashboard since the data is available till 21st feb so it should display the data from 21st Feb till now.

Or is there any way that we can set the conditions token that it search first for 24 hours then last 7 days then last 30 days and display the data only when its available. 

Is that possible to put any conditions tokens like that.

Below is my code for date/Dropdown:

<input type="time" token="field1" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
</input>

Below is my code for one query for panel when time token is set:

<row>
<panel>
<chart>
<title>Overall Salesforce User Licenses</title>
<search>
<query>index="abc" sourcetype="xyz" $type$ TotalLicenses!=0 | lookup Org_Alias.csv OrgFolderName OUTPUT OrgName as OrgName | search $OrgName$ |dedup OrgFolderName, LicenseName, SalesforceOrgId |chart sum(TotalLicenses) as "Total Licenses" sum(UnusedLicenses) as "Unused Licenses" sum(UsedLicenses) as "Used Licenses" by LicenseName</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>

Please guide me on this.

 

 

 

Labels (3)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!