Dashboards & Visualizations

Use Dropdown Selector to Choose Day Ranges

lennys26
Communicator

Hello.

I am trying to use a drop down selector (as opposed to the time selector) in my dashboard to create a token with an @d value in %e-%b-%Y %T.%L.

In other words, I want to provide users an option for "Today, Yesterday, This Week" and have that populate tokens with earliest (@d) & latest (@d+86399) value of that day.

Ex:

Input: User selects TODAY

Token.start:  16-jun-2022 00:00:00.000

Token.end: 16-jun-2022 23:59:59.999

This should be straight forward, but for some reason, I am racking my brain trying to get this.

Labels (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@lennys26 - You can use input something like this in the Simple XML.

   <input type="dropdown" token="release" searchWhenChanged="true">
      <label>Release</label>
      <choice value="Today">Today</choice>
      <choice value="Yesterday">Today</choice>
      <change>
        <condition label="Today">
          <set token="custom_earliest">-@d</set>
          <set token="custom_latest">now</set>
        </condition>
        <condition label="Yesterday">
          <set token="custom_earliest">-2d@d</set>
          <set token="custom_latest">-1d@d</set>
        </condition>
      </change>
      <default>Today</default>
    </input>

(I could be wrong in the values assigned, but this is the logic you can use.)

 

I hope this helps!!!

gcusello
SplunkTrust
SplunkTrust

Hi @lennys26,

you can create your own time defaults in [Settings -- User Interface -- Time Ranges]

remember to assign the new default Time ranges to the roles of your users.

Ciao.

Giuseppe

lennys26
Communicator

Thanks for the reply. Actually it is not for the time range of the search itself, but for secondary criteria in my DB that is being queried (DBXQUERY).  

So, for some more info, the variable will be used like this:

 

| dbxquery query=" 
SELECT <field1>, <field2>
FROM <db_name>
WHERE start_time >= <$start_time_tok$> AND start_time <$end_time_tok$>
AND segment_time between <$start_seg_tok$> AND <$end_seg_tok$> ;" 

 

I am trying to get the <start_seg_tok> and <end_seg_tok> to be the start and end of the particular day selected in the drop down.

I am not using the Splunk provided time selector in this case.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...