Dashboards & Visualizations

Modify custom tokens on time selector from another input (with run anywhere xml dashboard)

weidertc
Communicator

I have a time selector with custom tokens that control various aspects of the dashboard.  Changing the value of the time selector changes the values of the custom tokens.

I also have a separate input dropdown with a list of times taken from when our alerts fired.  I need to update the time selector when the alert dates/times are chosen so the panels below update with a timeframe showing what happened with alert.  When changing the value of the separate input dropdown to a new date, the 'earliest' and 'latest' update on the time selector, but none of its custom tokens do.  They only change when I change the time selector.

When I update input dropdowns with other input dropdown dynamically, they work, just not when I attempt to update the time selector from another input dropdown.

 

How can I update "all" tokens on the time selector, not just 'earliest' and 'latest' from the other dropdown?

 

 

 

<form theme="dark">
  <label>Time Issue</label>
  <description></description>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="time" searchWhenChanged="true">
      <label>Time Frame</label>
      <default>
        <earliest>@d-1d</earliest>
        <latest>now</latest>
      </default>
      <change>
        <eval token="time.earliest">if(len('earliest')=0 OR 'earliest="" OR isnull('earliest') OR 'earliest'="null" OR 'earliest'="0", "@d-90d", 'earliest')</eval>
        <eval token="time.latest">if('latest'="now" OR len('latest')=0 OR isnull('latest') OR 'latest'="null","@m",'latest')</eval>
        <eval token="time.earliest_type">if(match('earliest', ".*[@smhdwy].*"), "rel", "abs")</eval>
        <eval token="time.latest_type">if(match('latest', ".*[@smhdwy].*"), "rel", "abs")</eval>
        <eval token="time.earliest_epoch">if($time.earliest_type$="rel", relative_time(now(), 'earliest'), 'earliest')</eval>
        <eval token="time.latest_epoch">if($time.latest_type$="rel", relative_time(now(), 'latest'), 'latest')</eval>
        <eval token="time.difference">$time.latest_epoch$-$time.earliest_epoch$</eval>
        <eval token="form.panel">if($time.difference$&lt;=604801,"compare","single")</eval>
        <eval token="form.span">if($time.difference$&gt;2592000,"1d",if($time.difference$&gt;604800,"1h",if($time.difference$&gt;172800,"15m",if($time.difference$&gt;86400,"3m","1m"))))</eval>
        <eval token="time.earliest_day1">if($time.earliest_type$="rel", 'earliest' . "-1d", 'earliest'-86400)</eval>
        <eval token="time.earliest_day1_epoch">'earliest'-86400</eval>
        <eval token="time.latest_day1">if($time.latest_type$="rel", 'latest' . "-1d", 'latest'-86400)</eval>
        <eval token="time.latest_day1_epoch">'latest'-86400</eval>
        <eval token="time.earliest_week1">if($time.earliest_type$="rel", 'earliest' . "-1w", 'earliest'-604800)</eval>
        <eval token="time.earliest_week1_epoch">'earliest'-604800</eval>
        <eval token="time.latest_week1">if($time.latest_type$="rel", 'latest' . "-1w", 'latest'-604800)</eval>
        <eval token="time.latest_week1_epoch">'latest'-604800</eval>
      </change>
    </input>
    <input type="dropdown" token="span" searchWhenChanged="true">
      <label>Span</label>
      <choice value="1m">1 Minute</choice>
      <choice value="3m">3 Minute</choice>
      <choice value="5m">5 Minutes</choice>
      <choice value="10m">10 Minutes</choice>
      <choice value="15m">15 Minutes</choice>
      <choice value="30m">30 Minutes</choice>
      <choice value="1h">1 Hour</choice>
      <choice value="3h">3 Hours</choice>
      <choice value="6h">6 Hours</choice>
      <choice value="12h">12 Hours</choice>
      <choice value="1d">1 Day</choice>
      <change>
        <eval token="span.seconds">case($span$="1m", 60, $span$="3m", 180, $span$="5m", 300, $span$="10m", 600, $span$="15m", 900, $span$="30m", 1800, $span$="1h", 3600, $span$="3h", 10800, $span$="6h", 21600, $span$="12h", 43200, $span$="1d", 86400)</eval>
        <eval token="time.earliest_snap">(int($time.earliest_epoch$/$span.seconds$)*$span.seconds$)+$span.seconds$</eval>
        <eval token="time.latest_snap">int($time.latest_epoch$/$span.seconds$)*$span.seconds$</eval>
        <eval token="time.earliest_week1_snap">(int($time.earliest_week1_epoch$/$span.seconds$)*$span.seconds$)+$span.seconds$</eval>
        <eval token="time.latest_week1_snap">int($time.latest_week1_epoch$/$span.seconds$)*$span.seconds$</eval>
        <eval token="time.difference_snap">$time.latest_snap$-$time.earliest_snap$</eval>
        <eval token="span.intervals">ceil($time.difference$/$span.seconds$)</eval>
        <eval token="span.intervals_snap">$time.difference_snap$/$span.seconds$</eval>
      </change>
      <default>5m</default>
      <initialValue>5m</initialValue>
    </input>
    <input type="dropdown" token="panel" searchWhenChanged="true">
      <label>Panel</label>
      <choice value="single">Single</choice>
      <choice value="compare">Compare</choice>
      <change>
        <condition value="compare">
          <unset token="showPanelSingle"></unset>
          <set token="showPanelCompare">true</set>
        </condition>
        <condition value="single">
          <unset token="showPanelCompare"></unset>
          <set token="showPanelSingle">true</set>
        </condition>
      </change>
      <default>compare</default>
      <initialValue>compare</initialValue>
    </input>
    <input type="dropdown" token="timeOption" searchWhenChanged="true">
      <label>Choose a Time</label>
      <fieldForLabel>timeLabel</fieldForLabel>
      <fieldForValue>time</fieldForValue>
      <search>
        <done>
          <condition match="len('timeOption') != &quot;0&quot;">
            <unset token="form.time.earliest"></unset>
            <unset token="form.time.latest"></unset>
            <eval token="form.time.earliest">if($timeOption$ &gt; relative_time(now(), "@d-1d"), "@d-1d", relative_time($timeOption$, "@d-2h"))</eval>
            <eval token="form.time.latest">if($timeOption$ &gt; relative_time(now(), "@d-1d"), "@m", relative_time($timeOption$, "@d+1d+2h"))</eval>
          </condition>
        </done>
        <query>| makeresults count=5
| eval _time = floor((relative_time(_time, "@d") / 86400) * 86400)
| streamstats current=false count as _row
| eval time = _time - (_row * 86400)
| eval timeLabel = strftime(time, "%Y-%m-%d")</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <change>
        <condition match="len('timeOption') != &quot;0&quot;">
          <unset token="form.time.earliest"></unset>
          <unset token="form.time.latest"></unset>
          <eval token="form.time.earliest">if($timeOption$ &gt; relative_time(now(), "@d-1d"), "@d-1d", relative_time($timeOption$, "@d-2h"))</eval>
          <eval token="form.time.latest">if($timeOption$ &gt; relative_time(now(), "@d-1d"), "@m", relative_time($timeOption$, "@d+1d+2h"))</eval>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>timeOption</span></div>
          <div style="width: 300px; float: left;"><span>$timeOption$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.earliest</span></div>
          <div style="width: 300px; float: left;"><span>$time.earliest$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.latest</span></div>
          <div style="width: 300px; float: left;"><span>$time.latest$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.earliest_epoch</span></div>
          <div style="width: 300px; float: left;"><span>$time.earliest_epoch$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.latest_epoch</span></div>
          <div style="width: 300px; float: left;"><span>$time.latest_epoch$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.earliest_type</span></div>
          <div style="width: 300px; float: left;"><span>$time.earliest_type$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.latest_type</span></div>
          <div style="width: 300px; float: left;"><span>$time.latest_type$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.difference</span></div>
          <div style="width: 300px; float: left;"><span>$time.difference$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.earliest_day1</span></div>
          <div style="width: 300px; float: left;"><span>$time.earliest_day1$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.latest_day1</span></div>
          <div style="width: 300px; float: left;"><span>$time.latest_day1$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.earliest_day1_epoch</span></div>
          <div style="width: 300px; float: left;"><span>$time.earliest_day1_epoch$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.latest_day1_epoch</span></div>
          <div style="width: 300px; float: left;"><span>$time.latest_day1_epoch$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.earliest_week1</span></div>
          <div style="width: 300px; float: left;"><span>$time.earliest_week1$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.latest_week1</span></div>
          <div style="width: 300px; float: left;"><span>$time.latest_week1$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.earliest_week1_epoch</span></div>
          <div style="width: 300px; float: left;"><span>$time.earliest_week1_epoch$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>time.latest_week1_epoch</span></div>
          <div style="width: 300px; float: left;"><span>$time.latest_week1_epoch$</span></div>
        </div>
        <div style="width: 100%; clear: both;">
          <div style="width: 300px; float: left;"><span>panel</span></div>
          <div style="width: 300px; float: left;"><span>$panel$</span></div>
        </div>
      </html>
    </panel>
  </row>
</form>

 

 

Labels (2)
0 Karma

Gr0und_Z3r0
Contributor

Hi @weidertc 
You'll have to write a <change> block and set the tokens that needs an update to the desired value or its default value as per your use case.

0 Karma

weidertc
Communicator

I assume you mean the <change> block on the source input that's directly updated by the user.  this is only necessary for the native tokens.  the <change> block on the target input takes the native token and its own <change> block takes over, (regardless whether the user updated the source or target input,) not the one from the source input, then when the native tokens get updated from elsewhere dynamically, then only the <change> block on the target input matter.

except, as my issue describes, with the time selector input.  it behaves differently.  its own <change> block only executes when action is taken directly on itself, which is inconsistent with how it behaves on all other inputs.

as an example, watch how the custom token on the panel dropdown updates even though the time selector does not update it directly.

I'm hoping for a solution that doesn't require multiple sources of truth and replicate the entire <change> block of 30 tokens twice, one for each dropdown.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...