Dashboards & Visualizations

Return multiple values from dynamic Dropdown

Mandrecks
Loves-to-Learn

I am building a dashboard with the new dashboard builder and I have a dynmic dropdown which returns me these values:

timerange, rangeStart, rangeEnd, date

2024-03-07T09:10:23/2024-03-07T23:34:392024-03-07T09:10:232024-03-07T23:34:3907/03/24-07/03/24
2024-03-08T19:41:25/2024-03-08T23:28:542024-03-08T19:41:252024-03-08T23:28:5408/03/24-08/03/24
2024-03-11T19:36:52/2024-03-11T23:19:362024-03-11T19:36:522024-03-11T23:19:3611/03/24-11/03/24

 

These ranges can go over multiple days. I use the date column as my label in the dropdown which works fine. My problem now is that I want to use the rangeStart and rangeEnd as the earliest and latest times for my graphs.
My dropdown config looks like this:

{
    "options": {
        "items": ">frame(label, value, additional_value) | prepend(formattedStatics) | objects()",
        "token": "testrun",
        "selectFirstSearchResult": true
    },
    "title": "Testrun",
    "type": "input.dropdown",
    "dataSources": {
        "primary": "ds_w86GnMtx"
    },
    "context": {
        "formattedConfig": {
            "number": {
                "prefix": ""
            }
        },
        "formattedStatics": ">statics | formatByType(formattedConfig)",
        "statics": [],
        "label": ">primary | seriesByName(\"date\") | renameSeries(\"label\") | formatByType(formattedConfig)",
        "value": ">primary | seriesByName(\"rangeStart\") | renameSeries(\"value\") | formatByType(formattedConfig)",
        "additional_value": ">primary | seriesByName(\"rangeEnd\") | renameSeries(\"additional_value\") | formatByType(formattedConfig)"
    }
}
The token name for the dropdown is testrun 
 
My query config for the graph looks like this:
{
    "type": "ds.search",
    "options": {
        "query": "QUERY",
        "queryParameters": {
            "earliest": "$testrun$rangeStart$",
            "latest": "$testrun$rangeEnd$"
        },
        "enableSmartSources": true
    },
    "name": "cool graph"
}

It seems like the token $testrun$ itself returns the rangeStart, but these $testrun$rangeStart/rangeEnd$ don't work. Is it even possible to do something like that, that the dropdown returns multiple values?

If not is there a way to use the timerange from above and split it in the middle to get earliest and latest?
"earliest": "$testrun.timerange.split(\"/\")[0].strptime('%Y-%m-%dT%H:%M:%S')$",
"latest": "$testrun.timerange.split(\"/\")[1].strptime('%Y-%m-%dT%H:%M:%S')$"
I tried also this in different ways which I also couldn't get to work. The error I am getting is always "invalid earliest_time".
Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you considered using Classic / SimpleXML dashboard as you can probably achieve this with SimpleXML?

0 Karma

Mandrecks
Loves-to-Learn

Yes I thought about using the old dashboard builder as an alternative, but I wanted to see if it would be possible to use the new one.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...