Dashboards & Visualizations

How to set current month as default value in drop-down?

katrinamara
Path Finder

I have two drop-down inputs(from and to) where the user can choose the duration of the data to be displayed. I want to use the current month as default of the 2 inputs. How can I do that?

alt text

Here is my xml code for my 2 inputs.

   <input id="input1" type="dropdown" token="from_tok" searchWhenChanged="true">
        <label>From</label>
        <default></default>
        <intialvalue></intialvalue>
        <fieldForLabel>c_time_show</fieldForLabel>
        <fieldForValue>c_time_tok</fieldForValue>
        <search>
          <query>index="acn_pmo_ooo_tier1_idx" 
| rename "Approver Name" as Approver_Name, "Item Type" as Item_Type, "Leave End Date" as "Leave_End_Date", "Leave Start Date" as "Leave_Start_Date", "Leave Type" as "Leave_Type" ,"Total Working Hours on Leave" as Total_Working_Hours_on_Leave, "Supervisor Name" as Supervisor_Name 
| eval start=strptime(Leave_Start_Date,"%m/%d/%Y"), getend=strptime(Leave_End_Date,"%m/%d/%Y"), end=relative_time(getend, "+1day") 
| eval between= mvrange(start, end, "1d") 
| mvexpand between 
| sort between 
| eval c_time_show=strftime(between,"%B-%Y") , c_time_tok=strftime(between,"%b-01-%y"), default=now(), default=strftime(default,"%B-%Y"), 
    default_tok=now(), default_tok=strftime(default_tok,"%b-01-%y") 
| table c_time_show c_time_tok default default_tok 
| dedup c_time_show c_time_tok default</query>
          <earliest>0</earliest>
          <latest></latest>

        </search>
      </input>
      <input id="input2" type="dropdown" token="to_tok" searchWhenChanged="true">
        <label>To</label>
        <selectFirstChoice>true</selectFirstChoice>
        <fieldForLabel>c_time_show</fieldForLabel>
        <fieldForValue>c_time_tok</fieldForValue>
        <search>
          <query>index="acn_pmo_ooo_tier1_idx"
|dedup EID,"Resource Name","Leave Start Date","Leave Type"

| eval start_date= strptime('Leave Start Date',"%m/%d/%Y"),
       end_date=relative_time(relative_time(strptime('Leave End Date',"%m/%d/%Y"),"@d"), "+1day"),
       between=mvrange(start_date,end_date,"1d")
| mvexpand between
| eval insert=strftime(between,"%m/%d/%Y"), LSD=strptime(insert,"%m/%d/%Y"), _time=LSD
| convert ctime(between) timeformat="%A" 
| rename "Total Working Hours on Leave" as total_working_hours
| eval NoOfLeaveDays=mvcount(mvfilter(NOT match(between,"(Saturday|Sunday).*"))), hours=round(total_working_hours/NoOfLeaveDays,1)
| eval Leaves_value= case(match(between,"Saturday"),"",match(between,"Sunday"),"", 1=1,hours)

| rename "Training Name" as tn 
| eval ftrain=Leaves_value."#".tn
| eval fv = case(Leaves_value="EH",Leaves_value,Leaves_value="H",Leaves_value,Leaves_value="-",Leaves_value,Leaves_value="",Leaves_value,1=1,ftrain)
| timechart span=1d last(fv) by EID limit=0 
| eval twoway= strptime(strftime(_time,"%d/%m/%y"),"%d/%m/%y")

| eval get_tok="$from_tok$", make=strptime(get_tok,"%b-%d-%y") ,between=strptime(strftime(_time,"%b-%d-%y"),"%b-%d-%y")
| where make <= between

| eval c_time_tok=strftime(_time,"%b-%d-%y"),c_time_show=strftime(_time,"%B-%Y") 
| eventstats last(c_time_tok) as c_time_tok by c_time_show
| table c_time_show c_time_tok  
| sort twoway
| dedup c_time_tok</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <default>Mar-23-18</default>
        <initialValue>Mar-23-18</initialValue>
      </input>
0 Karma

surekhasplunk
Communicator

Hi @katrinamara

I have a similar requirement . Did you get this working ?

Thanks

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @katrinamara ,

Can you please try below code in your dashboard?

<form>
  <label>Dropdown Select</label>
  <search>
    <query>| makeresults  | eval current_month = strftime(now(),"%B-%Y") | table current_month</query>
    <done>
      <set token="tkn_current_month">$result.current_month$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input id="input1" type="dropdown" token="from_tok" searchWhenChanged="true">
      <label>From</label>
      <default>$tkn_current_month$</default>
      <fieldForLabel>month</fieldForLabel>
      <fieldForValue>month</fieldForValue>
      <search>
        <query>| makeresults | eval month="01,02,03,04,05,06,07,08,09,10,11,12" | makemv delim="," month | stats count by month | eval month = "01-".month."-2018" | eval month = strftime(strptime(month."-2018","%d-%m-%Y"),"%B-%Y") | table month</query>
      </search>
    </input>
  </fieldset>
</form>

I have added below code which is set current month value in token, which is used as default value in dropdown.

 <search>
        <query>| makeresults  | eval current_month = strftime(now(),"%B-%Y") | table current_month</query>
        <done>
          <set token="tkn_current_month">$result.current_month$</set>
        </done>
      </search>

Thanks

0 Karma

katrinamara
Path Finder

Hi, the value for drop-down should come from the Leave Start Date and Leave End Date in our data. I don't think I can declare the month as shown above.

0 Karma
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...