how to use range of numbers in token

[anooshac]

Hi all, I have a token "Duration", and the values which will be passed to the drilldown are duration<15, 15<duration<=25 and duration>25. How can i pass the value 15-25 as a token?

[gcusello]

Hi @anooshac,

you could use a dropdown list or a radio button with three static options, something like this:

<input type="dropdown" token="range">
      <label>Range</label>
      <choice value="duration<16">duration<15</choice>
      <choice value="(duration>15 AND duration<=25)">15<duration<=25</choice>
      <choice value="duration>25">duration>25</choice>
      <default>duration<16</default>
      <prefix></prefix>
      <suffix></suffix>
      <search>
        <query></query>
      </search>
    </input>

and then use the clicked value in a search command.

| search $range$

Ciao.

Giuseppe

[anooshac]

Actually i want to pass the value to a table to populate the data. Do you know how to pass 15-25 directly as a token?

[gcusello]

Hi @anooshac,

if you have only one threshold (e.g. duratiopn<15 or duration>=15), you could pass only the value, but there's the intermediate range that has two conditions to check (duration>15 AND duration<=25), for this reason I hint to pass the full condition to use in the where command, as you can see in my sample.

If you want to pass only the value, you could use two dropdowns: one for the minimum and one for the maximum range.

Ciao.

Giuseppe

[anooshac]

Can i pass the value 15-25 as whole? Is there anything that can solve this?

[gcusello]

Hi @anooshac,

no, this is a range, a range is always composed by two conditions, so you cannot do in a different way.

What's the problem to use a condition like the one I showed?

Ciao.

Giuseppe

[anooshac]

hi, Your solution is perfect. But what i have is a bar chart which has these 3 groups and when i click any of the bar it should pass the value to the table in the drill down. I don't know that is possible.

[gcusello]

Hi @anooshac,

you could pass in the drilldown the condition (1, 2 or 3) and then manage in the secondary form the condition:

| eval minor=case(cond=1,0,cond=2,15,cond=3,25), major=case(cond=1,15,cond=2,25,cond=3,100000000000000000000000)
| search duration>minor duration<=major

Ciao.,

Giuseppe

[anooshac]

should i add the condition as |where cond=1 2 or 3 in the query?

[gcusello]

Hi @anooshac,

in the drilldown you have to pass the condition and in the searches of the secondaty dashboard you have to use the eval and search commands I hinted.

Ciao.

Giuseppe

[isoutamo]

When you are using g token on dashboards, use it in SPL just $token_name$. 

https://docs.splunk.com/Documentation/Splunk/8.2.4/Viz/tokens

[anooshac]

I tried directly using the token but it doesn't work for the numbers with range. How can i pass a range 15-25 in a token ?