Dashboards & Visualizations

Return multiple values from dynamic Dropdown

Mandrecks
Loves-to-Learn

I am building a dashboard with the new dashboard builder and I have a dynmic dropdown which returns me these values:

timerange, rangeStart, rangeEnd, date

2024-03-07T09:10:23/2024-03-07T23:34:392024-03-07T09:10:232024-03-07T23:34:3907/03/24-07/03/24
2024-03-08T19:41:25/2024-03-08T23:28:542024-03-08T19:41:252024-03-08T23:28:5408/03/24-08/03/24
2024-03-11T19:36:52/2024-03-11T23:19:362024-03-11T19:36:522024-03-11T23:19:3611/03/24-11/03/24

 

These ranges can go over multiple days. I use the date column as my label in the dropdown which works fine. My problem now is that I want to use the rangeStart and rangeEnd as the earliest and latest times for my graphs.
My dropdown config looks like this:

{
    "options": {
        "items": ">frame(label, value, additional_value) | prepend(formattedStatics) | objects()",
        "token": "testrun",
        "selectFirstSearchResult": true
    },
    "title": "Testrun",
    "type": "input.dropdown",
    "dataSources": {
        "primary": "ds_w86GnMtx"
    },
    "context": {
        "formattedConfig": {
            "number": {
                "prefix": ""
            }
        },
        "formattedStatics": ">statics | formatByType(formattedConfig)",
        "statics": [],
        "label": ">primary | seriesByName(\"date\") | renameSeries(\"label\") | formatByType(formattedConfig)",
        "value": ">primary | seriesByName(\"rangeStart\") | renameSeries(\"value\") | formatByType(formattedConfig)",
        "additional_value": ">primary | seriesByName(\"rangeEnd\") | renameSeries(\"additional_value\") | formatByType(formattedConfig)"
    }
}
The token name for the dropdown is testrun 
 
My query config for the graph looks like this:
{
    "type": "ds.search",
    "options": {
        "query": "QUERY",
        "queryParameters": {
            "earliest": "$testrun$rangeStart$",
            "latest": "$testrun$rangeEnd$"
        },
        "enableSmartSources": true
    },
    "name": "cool graph"
}

It seems like the token $testrun$ itself returns the rangeStart, but these $testrun$rangeStart/rangeEnd$ don't work. Is it even possible to do something like that, that the dropdown returns multiple values?

If not is there a way to use the timerange from above and split it in the middle to get earliest and latest?
"earliest": "$testrun.timerange.split(\"/\")[0].strptime('%Y-%m-%dT%H:%M:%S')$",
"latest": "$testrun.timerange.split(\"/\")[1].strptime('%Y-%m-%dT%H:%M:%S')$"
I tried also this in different ways which I also couldn't get to work. The error I am getting is always "invalid earliest_time".
Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you considered using Classic / SimpleXML dashboard as you can probably achieve this with SimpleXML?

0 Karma

Mandrecks
Loves-to-Learn

Yes I thought about using the old dashboard builder as an alternative, but I wanted to see if it would be possible to use the new one.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...