Dashboards & Visualizations

How to run searches using different time ranges in dropdown?

dzyfer
Path Finder

Hi, I would like to know how to run searches using different time ranges in dropdown.


For example, an input in the dropdown would be labelled "Yesterday", and I would like to assign 2 different time ranges to the same label, such that I can run 2 different searches using the separate time ranges by just selecting one input from the dropdown.

I have tried defining 4 tokens under the same label, but it doesn't work, ie.

 

<choice value="yesterday">Yesterday</choice>
 <condition label="Yesterday">
  <set token="custom_earliest">-8d@d+7h</set>
  <set token="custom_latest">@d+7h</set>
  <set token="breakdown_earliest">-1d@d+7h</set>
  <set token="breakdown_latest">@d+7h</set>
</condition>

 

 Thanks

Labels (4)
0 Karma
1 Solution

chaker
Contributor

A few things to try:

Print out the tokens in a panel to make sure they are being set to the value you expect. You may need to use dot notation, so what ever the token name of your input is.

<input type="dropdown" token="my_date">

my_date.custom_earliest
my_date.custom_latest

Try wrapping the time modifer in quotes

<set token="custom_latest">"@d+7h"</set>

Try matching condition value instead of label. Should be the same, but worth a try.

 

View solution in original post

0 Karma

chaker
Contributor

A few things to try:

Print out the tokens in a panel to make sure they are being set to the value you expect. You may need to use dot notation, so what ever the token name of your input is.

<input type="dropdown" token="my_date">

my_date.custom_earliest
my_date.custom_latest

Try wrapping the time modifer in quotes

<set token="custom_latest">"@d+7h"</set>

Try matching condition value instead of label. Should be the same, but worth a try.

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...