Dashboards & Visualizations

How to update timepicker on another input change in dashboard

C_HIEN
Path Finder

I have a dashboard with 2 inputs fields
* a dropdown to choose a lookup file
* a timepicker (token=timerange)

Is it possible to update the timepicker tokens (earliest and latest) when i update the dropdown value? and if yes, the process:

  • I select a lookup file on the dropdown list
  • The lookup file contains 2 timestamps fields i want to use

Sample of the lookup file:

value,from,to
something,timestamp1,timestamp2

I try to add this to input in simplexml dashboard on dropdown declaration:

<change>
<eval token="timerange.earliest">[| inputlookup lookup.csv | stats min(from) as from | return $from ]</eval>
<eval token="timerange.latest">[| inputlookup lookup.csv | stats max(to) as to | return $to ]</eval>
</change>

without any results ...

I also tried to make a small js file to attach on dropdown change event....no success here

If you have an idea...

1 Solution

woodcock
Esteemed Legend

What you need to do is create an base search that is not embedded in a panel that has some thing like this SPL | inputlookup lookup.csv | stats min(from) AS from max(to) AS to (perhaps with the lookup.csv being a token matching the name of the lookup selected from another field). Then set the token in the change section like this:

<change>
   <eval token="timerange.earliest">from</eval>
   <eval token="timerange.latest">to</eval>
</change>

View solution in original post

0 Karma

woodcock
Esteemed Legend

What you need to do is create an base search that is not embedded in a panel that has some thing like this SPL | inputlookup lookup.csv | stats min(from) AS from max(to) AS to (perhaps with the lookup.csv being a token matching the name of the lookup selected from another field). Then set the token in the change section like this:

<change>
   <eval token="timerange.earliest">from</eval>
   <eval token="timerange.latest">to</eval>
</change>
0 Karma

C_HIEN
Path Finder

Thanks for your answer ! It was a great idea and l've finally a working result.

As you said i have defined a base search which depends of a token $lookup$.
In the search definition i've added a condition to be sure it returns results and then eval timerange.earliest and timerange.latest tokens ( eval of form.timerange.earliest and form.timerange.latest refresh timepicker content ...nice!)

I've checked "run search on change" for the dropdown list i use to select the lookup.

And the magic happens !

PS: I will update this post with my dashboard source

0 Karma

woodcock
Esteemed Legend

Yes, please do post it as a folloup here so this is a wholly complete answer.

0 Karma

sandeepmakkena
Contributor
<change>
 <eval token="timerange.earliest">[| inputlookup lookup.csv |output from | dedup from | sort from | head 1]</eval>
 <eval token="timerange.latest">[| inputlookup lookup.csv |output from | dedup to | sort -to | head 1 ]</eval>
 </change>

<set token="timerange.earliest">$result.from$</set> 
<set token="timerange.latest">$result.to$</set>

Set those values to tokens something like above should work.
Hope this helps, Please let me know if you have any questions.Thanks!

0 Karma

C_HIEN
Path Finder

Thanks for your answer but i don't understand where i have to put both

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...