Dashboards & Visualizations

Return multiple values from dynamic Dropdown

Mandrecks
Loves-to-Learn

I am building a dashboard with the new dashboard builder and I have a dynmic dropdown which returns me these values:

timerange, rangeStart, rangeEnd, date

2024-03-07T09:10:23/2024-03-07T23:34:392024-03-07T09:10:232024-03-07T23:34:3907/03/24-07/03/24
2024-03-08T19:41:25/2024-03-08T23:28:542024-03-08T19:41:252024-03-08T23:28:5408/03/24-08/03/24
2024-03-11T19:36:52/2024-03-11T23:19:362024-03-11T19:36:522024-03-11T23:19:3611/03/24-11/03/24

 

These ranges can go over multiple days. I use the date column as my label in the dropdown which works fine. My problem now is that I want to use the rangeStart and rangeEnd as the earliest and latest times for my graphs.
My dropdown config looks like this:

{
    "options": {
        "items": ">frame(label, value, additional_value) | prepend(formattedStatics) | objects()",
        "token": "testrun",
        "selectFirstSearchResult": true
    },
    "title": "Testrun",
    "type": "input.dropdown",
    "dataSources": {
        "primary": "ds_w86GnMtx"
    },
    "context": {
        "formattedConfig": {
            "number": {
                "prefix": ""
            }
        },
        "formattedStatics": ">statics | formatByType(formattedConfig)",
        "statics": [],
        "label": ">primary | seriesByName(\"date\") | renameSeries(\"label\") | formatByType(formattedConfig)",
        "value": ">primary | seriesByName(\"rangeStart\") | renameSeries(\"value\") | formatByType(formattedConfig)",
        "additional_value": ">primary | seriesByName(\"rangeEnd\") | renameSeries(\"additional_value\") | formatByType(formattedConfig)"
    }
}
The token name for the dropdown is testrun 
 
My query config for the graph looks like this:
{
    "type": "ds.search",
    "options": {
        "query": "QUERY",
        "queryParameters": {
            "earliest": "$testrun$rangeStart$",
            "latest": "$testrun$rangeEnd$"
        },
        "enableSmartSources": true
    },
    "name": "cool graph"
}

It seems like the token $testrun$ itself returns the rangeStart, but these $testrun$rangeStart/rangeEnd$ don't work. Is it even possible to do something like that, that the dropdown returns multiple values?

If not is there a way to use the timerange from above and split it in the middle to get earliest and latest?
"earliest": "$testrun.timerange.split(\"/\")[0].strptime('%Y-%m-%dT%H:%M:%S')$",
"latest": "$testrun.timerange.split(\"/\")[1].strptime('%Y-%m-%dT%H:%M:%S')$"
I tried also this in different ways which I also couldn't get to work. The error I am getting is always "invalid earliest_time".
Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you considered using Classic / SimpleXML dashboard as you can probably achieve this with SimpleXML?

0 Karma

Mandrecks
Loves-to-Learn

Yes I thought about using the old dashboard builder as an alternative, but I wanted to see if it would be possible to use the new one.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...