Dashboards & Visualizations

How to set up custom logic for conditional tokens in views?

kamal_jagga
Contributor

Hi,

I often face the issue that my data comes late, so I am developing a retro run dashboard. Now my searches have multiple sourcetypes joined together with different earliest and latest values.
Now I want to automate the process of evaluating the earliest and latest values depending on the date. So my tokens would be like:

earliest1=x(will enter manually from dashboard)
latest1=$earliest1$+5
earliest2=$earliest1$+2
latest2=$earliest1$+1

Now, I think this can be done. Found the following details in documentation.

Custom logic examples
You can use an eval expression in event handler elements. Here is an example.

. . . [conditional actions] . . .

You can also compute a token's value based on the result of an eval expression. Here is an example.
[eval expression]

But I am unable to implement it. My code is :

<panel>
  <title>Time Range Picker for Test Search</title>
  <input type="dropdown" token="early" searchWhenChanged="true">
    <label>Earliest Time</label>
    <choice value="-150d@d">150 Days</choice>
    <choice value="-200d@d">200 days</choice>
    <default value="-150d@d">150 Days</default>
 <eval token="late">[$early$-50]</eval>
  </input>   
 </panel>

or, something like :

  <eval x>[$early$-50]</eval>
  <eval token="late">[x-50]</eval>

x is just a variable.

Any advice is appreciated.

0 Karma
1 Solution

kamal_jagga
Contributor

I found a solution to this.
Put a textbox to get value of token

Search would look like.:
index=cricket latest= -7d@d-$token$d@d | head 1| table _time _raw

eg. you want to retro run by 7 days. Put value =7 in token
And search would translate to
index=cricket latest= -7d@d-7d@d | head 1| table _time _raw

i.e will run on data 7 days older data.

View solution in original post

0 Karma

kamal_jagga
Contributor

I found a solution to this.
Put a textbox to get value of token

Search would look like.:
index=cricket latest= -7d@d-$token$d@d | head 1| table _time _raw

eg. you want to retro run by 7 days. Put value =7 in token
And search would translate to
index=cricket latest= -7d@d-7d@d | head 1| table _time _raw

i.e will run on data 7 days older data.

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...