Dashboards & Visualizations

How to set up custom logic for conditional tokens in views?

kamal_jagga
Contributor

Hi,

I often face the issue that my data comes late, so I am developing a retro run dashboard. Now my searches have multiple sourcetypes joined together with different earliest and latest values.
Now I want to automate the process of evaluating the earliest and latest values depending on the date. So my tokens would be like:

earliest1=x(will enter manually from dashboard)
latest1=$earliest1$+5
earliest2=$earliest1$+2
latest2=$earliest1$+1

Now, I think this can be done. Found the following details in documentation.

Custom logic examples
You can use an eval expression in event handler elements. Here is an example.

. . . [conditional actions] . . .

You can also compute a token's value based on the result of an eval expression. Here is an example.
[eval expression]

But I am unable to implement it. My code is :

<panel>
  <title>Time Range Picker for Test Search</title>
  <input type="dropdown" token="early" searchWhenChanged="true">
    <label>Earliest Time</label>
    <choice value="-150d@d">150 Days</choice>
    <choice value="-200d@d">200 days</choice>
    <default value="-150d@d">150 Days</default>
 <eval token="late">[$early$-50]</eval>
  </input>   
 </panel>

or, something like :

  <eval x>[$early$-50]</eval>
  <eval token="late">[x-50]</eval>

x is just a variable.

Any advice is appreciated.

0 Karma
1 Solution

kamal_jagga
Contributor

I found a solution to this.
Put a textbox to get value of token

Search would look like.:
index=cricket latest= -7d@d-$token$d@d | head 1| table _time _raw

eg. you want to retro run by 7 days. Put value =7 in token
And search would translate to
index=cricket latest= -7d@d-7d@d | head 1| table _time _raw

i.e will run on data 7 days older data.

View solution in original post

0 Karma

kamal_jagga
Contributor

I found a solution to this.
Put a textbox to get value of token

Search would look like.:
index=cricket latest= -7d@d-$token$d@d | head 1| table _time _raw

eg. you want to retro run by 7 days. Put value =7 in token
And search would translate to
index=cricket latest= -7d@d-7d@d | head 1| table _time _raw

i.e will run on data 7 days older data.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...