Dashboards & Visualizations

Span & timepicker

KarunK
Contributor

Hi All,

I would like to give the users an option/control for span in a pull-down based on the value of the time-range picker. This is to prevent the users from using 5min window on 30 day search as the results get truncated in time-charts.

Any Ideas ???

Last 24 hours -> span=5min

Last 7days    -> span=1hr

Last 30days   -> span=1day

etc etc etc

Thanks for your help

Regards

KK

Tags (2)

gyslainlatsa
Motivator

hi KarunK,
try use this example.

<form>
  <label>Time Picker Form Input Element</label>
  <description>Count Source by Time Period using Time Picker</description>

  <fieldset autoRun="true" submitButton="false">       
    <input type="dropdown" token="level" searchWhenChanged="true">
        <label>TimeRange:</label>
        <choice value="-30d@h">Last 30 days</choice>
        <choice value="-7d@h">Last 7 days</choice>
        <choice value="-24h@h">Last 24 hours</choice>
        <choice value="-4h@h">Last 4 hours</choice>
        <choice value="-60m@m">Last 60 minutes</choice>
        <choice value="-15m@m">Last 15 minutes</choice>
        <default>Last 30 days</default>
        <change>
          <condition value="-30d@h">
            <set token="s_level">4 days </set>
          </condition>

          <condition value="-7d@h">
            <set token="s_level">1 day </set>
          </condition>

          <condition value="-24h@h">
            <set token="s_level">6 hours </set>
          </condition>

          <condition value="-4h@h">
            <set token="s_level">1 hour </set>
          </condition>

          <condition value="-60m@m">
            <set token="s_level">10 min </set>
          </condition>

          <condition value="-15m@m">
            <set token="s_level">5 min </set>
          </condition>

        </change>
      </input>
  </fieldset>

  <row>
    <panel>
     <html>
       <h1 style="color:blue;text-align:center"> span=$s_level$ </h1>
    </html>
    </panel>
  </row>

  <row> 
     <panel>
    <chart>
      <title>Chart of Top Sourcetypes between $level$ and $latest$</title>
      <searchString>index=_internal earliest=$level$ latest=now |timechart count by source</searchString>
    </chart>
    </panel>
  </row>
</form>

KarunK
Contributor

No that wont work for us, we are quite a time dependent - internet traffic application. So we prefer a time based reports.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

As a different idea, have you considered giving them control over the number of bins rather than the span?

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...