Dashboards & Visualizations

Span & timepicker

KarunK
Contributor

Hi All,

I would like to give the users an option/control for span in a pull-down based on the value of the time-range picker. This is to prevent the users from using 5min window on 30 day search as the results get truncated in time-charts.

Any Ideas ???

Last 24 hours -> span=5min

Last 7days    -> span=1hr

Last 30days   -> span=1day

etc etc etc

Thanks for your help

Regards

KK

Tags (2)

gyslainlatsa
Motivator

hi KarunK,
try use this example.

<form>
  <label>Time Picker Form Input Element</label>
  <description>Count Source by Time Period using Time Picker</description>

  <fieldset autoRun="true" submitButton="false">       
    <input type="dropdown" token="level" searchWhenChanged="true">
        <label>TimeRange:</label>
        <choice value="-30d@h">Last 30 days</choice>
        <choice value="-7d@h">Last 7 days</choice>
        <choice value="-24h@h">Last 24 hours</choice>
        <choice value="-4h@h">Last 4 hours</choice>
        <choice value="-60m@m">Last 60 minutes</choice>
        <choice value="-15m@m">Last 15 minutes</choice>
        <default>Last 30 days</default>
        <change>
          <condition value="-30d@h">
            <set token="s_level">4 days </set>
          </condition>

          <condition value="-7d@h">
            <set token="s_level">1 day </set>
          </condition>

          <condition value="-24h@h">
            <set token="s_level">6 hours </set>
          </condition>

          <condition value="-4h@h">
            <set token="s_level">1 hour </set>
          </condition>

          <condition value="-60m@m">
            <set token="s_level">10 min </set>
          </condition>

          <condition value="-15m@m">
            <set token="s_level">5 min </set>
          </condition>

        </change>
      </input>
  </fieldset>

  <row>
    <panel>
     <html>
       <h1 style="color:blue;text-align:center"> span=$s_level$ </h1>
    </html>
    </panel>
  </row>

  <row> 
     <panel>
    <chart>
      <title>Chart of Top Sourcetypes between $level$ and $latest$</title>
      <searchString>index=_internal earliest=$level$ latest=now |timechart count by source</searchString>
    </chart>
    </panel>
  </row>
</form>

KarunK
Contributor

No that wont work for us, we are quite a time dependent - internet traffic application. So we prefer a time based reports.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

As a different idea, have you considered giving them control over the number of bins rather than the span?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...