Dashboards & Visualizations

how to use range of numbers in token

anooshac
Communicator

Hi all, I have a token "Duration", and the values which will be passed to the drilldown are duration<15, 15<duration<=25 and duration>25. How can i pass the value 15-25 as a token?

Labels (3)
0 Karma

gcusello
Legend

Hi @anooshac,

you could use a dropdown list or a radio button with three static options, something like this:

<input type="dropdown" token="range">
      <label>Range</label>
      <choice value="duration<16">duration<15</choice>
      <choice value="(duration>15 AND duration<=25)">15<duration<=25</choice>
      <choice value="duration>25">duration>25</choice>
      <default>duration<16</default>
      <prefix></prefix>
      <suffix></suffix>
      <search>
        <query></query>
      </search>
    </input>

and then use the clicked value in a search command.

| search $range$

Ciao.

Giuseppe

0 Karma

anooshac
Communicator

Actually i want to pass the value to a table to populate the data. Do you know how to pass 15-25 directly as a token?

0 Karma

gcusello
Legend

Hi @anooshac,

if you have only one threshold (e.g. duratiopn<15 or duration>=15), you could pass only the value, but there's the intermediate range that has two conditions to check (duration>15 AND duration<=25), for this reason I hint to pass the full condition to use in the where command, as you can see in my sample.

If you want to pass only the value, you could use two dropdowns: one for the minimum and one for the maximum range.

Ciao.

Giuseppe

0 Karma

anooshac
Communicator

Can i pass the value 15-25 as whole? Is there anything that can solve this?

0 Karma

gcusello
Legend

Hi @anooshac,

no, this is a range, a range is always composed by two conditions, so you cannot do in a different way.

What's the problem to use a condition like the one I showed?

Ciao.

Giuseppe

0 Karma

anooshac
Communicator

hi, Your solution is perfect. But what i have is a bar chart which has these 3 groups and when i click any of the bar it should pass the value to the table in the drill down. I don't know that is possible.

0 Karma

gcusello
Legend

Hi @anooshac,

you could pass in the drilldown the condition (1, 2 or 3) and then manage in the secondary form the condition:

| eval minor=case(cond=1,0,cond=2,15,cond=3,25), major=case(cond=1,15,cond=2,25,cond=3,100000000000000000000000)
| search duration>minor duration<=major

Ciao.,

Giuseppe

0 Karma

anooshac
Communicator

should i add the condition as |where cond=1 2 or 3 in the query?

0 Karma

gcusello
Legend

Hi @anooshac,

in the drilldown you have to pass the condition and in the searches of the secondaty dashboard you have to use the eval and search commands I hinted.

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

When you are using g token on dashboards, use it in SPL just $token_name$. 

https://docs.splunk.com/Documentation/Splunk/8.2.4/Viz/tokens

0 Karma

anooshac
Communicator

I tried directly using the token but it doesn't work for the numbers with range. How can i pass a range 15-25 in a token ?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...