Hi,
I often face the issue that my data comes late, so I am developing a retro run dashboard. Now my searches have multiple sourcetypes joined together with different earliest and latest values.
Now I want to automate the process of evaluating the earliest and latest values depending on the date. So my tokens would be like:
earliest1=x(will enter manually from dashboard)
latest1=$earliest1$+5
earliest2=$earliest1$+2
latest2=$earliest1$+1
Now, I think this can be done. Found the following details in documentation.
Custom logic examples
You can use an eval expression in event handler elements. Here is an example.
. . . [conditional actions] . . .
You can also compute a token's value based on the result of an eval expression. Here is an example.
[eval expression]
But I am unable to implement it. My code is :
<panel>
<title>Time Range Picker for Test Search</title>
<input type="dropdown" token="early" searchWhenChanged="true">
<label>Earliest Time</label>
<choice value="-150d@d">150 Days</choice>
<choice value="-200d@d">200 days</choice>
<default value="-150d@d">150 Days</default>
<eval token="late">[$early$-50]</eval>
</input>
</panel>
or, something like :
<eval x>[$early$-50]</eval>
<eval token="late">[x-50]</eval>
x is just a variable.
Any advice is appreciated.
I found a solution to this.
Put a textbox to get value of token
Search would look like.:
index=cricket latest= -7d@d-$token$d@d | head 1| table _time _raw
eg. you want to retro run by 7 days. Put value =7 in token
And search would translate to
index=cricket latest= -7d@d-7d@d | head 1| table _time _raw
i.e will run on data 7 days older data.
I found a solution to this.
Put a textbox to get value of token
Search would look like.:
index=cricket latest= -7d@d-$token$d@d | head 1| table _time _raw
eg. you want to retro run by 7 days. Put value =7 in token
And search would translate to
index=cricket latest= -7d@d-7d@d | head 1| table _time _raw
i.e will run on data 7 days older data.