Dashboards & Visualizations

How to run searches using different time ranges in dropdown?

dzyfer
Path Finder

Hi, I would like to know how to run searches using different time ranges in dropdown.


For example, an input in the dropdown would be labelled "Yesterday", and I would like to assign 2 different time ranges to the same label, such that I can run 2 different searches using the separate time ranges by just selecting one input from the dropdown.

I have tried defining 4 tokens under the same label, but it doesn't work, ie.

 

<choice value="yesterday">Yesterday</choice>
 <condition label="Yesterday">
  <set token="custom_earliest">-8d@d+7h</set>
  <set token="custom_latest">@d+7h</set>
  <set token="breakdown_earliest">-1d@d+7h</set>
  <set token="breakdown_latest">@d+7h</set>
</condition>

 

 Thanks

Labels (4)
0 Karma
1 Solution

chaker
Contributor

A few things to try:

Print out the tokens in a panel to make sure they are being set to the value you expect. You may need to use dot notation, so what ever the token name of your input is.

<input type="dropdown" token="my_date">

my_date.custom_earliest
my_date.custom_latest

Try wrapping the time modifer in quotes

<set token="custom_latest">"@d+7h"</set>

Try matching condition value instead of label. Should be the same, but worth a try.

 

View solution in original post

0 Karma

chaker
Contributor

A few things to try:

Print out the tokens in a panel to make sure they are being set to the value you expect. You may need to use dot notation, so what ever the token name of your input is.

<input type="dropdown" token="my_date">

my_date.custom_earliest
my_date.custom_latest

Try wrapping the time modifer in quotes

<set token="custom_latest">"@d+7h"</set>

Try matching condition value instead of label. Should be the same, but worth a try.

 

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...