Dashboards & Visualizations

How to set up custom logic for conditional tokens in views?

kamal_jagga
Contributor

Hi,

I often face the issue that my data comes late, so I am developing a retro run dashboard. Now my searches have multiple sourcetypes joined together with different earliest and latest values.
Now I want to automate the process of evaluating the earliest and latest values depending on the date. So my tokens would be like:

earliest1=x(will enter manually from dashboard)
latest1=$earliest1$+5
earliest2=$earliest1$+2
latest2=$earliest1$+1

Now, I think this can be done. Found the following details in documentation.

Custom logic examples
You can use an eval expression in event handler elements. Here is an example.

. . . [conditional actions] . . .

You can also compute a token's value based on the result of an eval expression. Here is an example.
[eval expression]

But I am unable to implement it. My code is :

<panel>
  <title>Time Range Picker for Test Search</title>
  <input type="dropdown" token="early" searchWhenChanged="true">
    <label>Earliest Time</label>
    <choice value="-150d@d">150 Days</choice>
    <choice value="-200d@d">200 days</choice>
    <default value="-150d@d">150 Days</default>
 <eval token="late">[$early$-50]</eval>
  </input>   
 </panel>

or, something like :

  <eval x>[$early$-50]</eval>
  <eval token="late">[x-50]</eval>

x is just a variable.

Any advice is appreciated.

0 Karma
1 Solution

kamal_jagga
Contributor

I found a solution to this.
Put a textbox to get value of token

Search would look like.:
index=cricket latest= -7d@d-$token$d@d | head 1| table _time _raw

eg. you want to retro run by 7 days. Put value =7 in token
And search would translate to
index=cricket latest= -7d@d-7d@d | head 1| table _time _raw

i.e will run on data 7 days older data.

View solution in original post

0 Karma

kamal_jagga
Contributor

I found a solution to this.
Put a textbox to get value of token

Search would look like.:
index=cricket latest= -7d@d-$token$d@d | head 1| table _time _raw

eg. you want to retro run by 7 days. Put value =7 in token
And search would translate to
index=cricket latest= -7d@d-7d@d | head 1| table _time _raw

i.e will run on data 7 days older data.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...