Dashboards & Visualizations

Span & timepicker

KarunK
Contributor

Hi All,

I would like to give the users an option/control for span in a pull-down based on the value of the time-range picker. This is to prevent the users from using 5min window on 30 day search as the results get truncated in time-charts.

Any Ideas ???

Last 24 hours -> span=5min

Last 7days    -> span=1hr

Last 30days   -> span=1day

etc etc etc

Thanks for your help

Regards

KK

Tags (2)

gyslainlatsa
Motivator

hi KarunK,
try use this example.

<form>
  <label>Time Picker Form Input Element</label>
  <description>Count Source by Time Period using Time Picker</description>

  <fieldset autoRun="true" submitButton="false">       
    <input type="dropdown" token="level" searchWhenChanged="true">
        <label>TimeRange:</label>
        <choice value="-30d@h">Last 30 days</choice>
        <choice value="-7d@h">Last 7 days</choice>
        <choice value="-24h@h">Last 24 hours</choice>
        <choice value="-4h@h">Last 4 hours</choice>
        <choice value="-60m@m">Last 60 minutes</choice>
        <choice value="-15m@m">Last 15 minutes</choice>
        <default>Last 30 days</default>
        <change>
          <condition value="-30d@h">
            <set token="s_level">4 days </set>
          </condition>

          <condition value="-7d@h">
            <set token="s_level">1 day </set>
          </condition>

          <condition value="-24h@h">
            <set token="s_level">6 hours </set>
          </condition>

          <condition value="-4h@h">
            <set token="s_level">1 hour </set>
          </condition>

          <condition value="-60m@m">
            <set token="s_level">10 min </set>
          </condition>

          <condition value="-15m@m">
            <set token="s_level">5 min </set>
          </condition>

        </change>
      </input>
  </fieldset>

  <row>
    <panel>
     <html>
       <h1 style="color:blue;text-align:center"> span=$s_level$ </h1>
    </html>
    </panel>
  </row>

  <row> 
     <panel>
    <chart>
      <title>Chart of Top Sourcetypes between $level$ and $latest$</title>
      <searchString>index=_internal earliest=$level$ latest=now |timechart count by source</searchString>
    </chart>
    </panel>
  </row>
</form>

KarunK
Contributor

No that wont work for us, we are quite a time dependent - internet traffic application. So we prefer a time based reports.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

As a different idea, have you considered giving them control over the number of bins rather than the span?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...