Dashboards & Visualizations

need infomation about xml

Explorer

in this program :-

Use tokens with input choices to capture input labels and values

Last 7 Days
-7d@d

<input type="radio" token="period_tok">
  <label>Select a time range</label>
  <choice value="-24h@h">Last 24 Hours</choice>
  <choice value="-7d@d">Last 7 Days</choice>
  <choice value="-30d@d">Last 30 Days</choice>
  <default>Last 7 Days</default>

  <change>
      <!-- use predefined input tokens to set -->
      <!-- tokens for the selected label and value -->
      <set token="date_label">$label$</set>
      <set token="earliest_tok">$value$</set>
  </change>

</input>



<panel>
  <title>Conditional Inputs</title>
  <chart>
    <!-- Display selected label in the title -->
    <title>Source Type by $date_label$</title>

    <search>
      <query>index = _internal | timechart count by sourcetype</query>
      <!-- use the value of earliest_tok -->
      <!-- to set the time range         -->
      <earliest>$earliest_tok$</earliest>
      <latest>now</latest>
    </search>

    <option name="charting.axisY.scale">log</option>
    <option name="charting.axisTitleX.text">Time period</option>
    <option name="charting.axisTitleY.text">Events</option>
  </chart>
</panel>

my question as below :-
1)
Last 7 Days
-7d@d
, what is use of it .
2) token="period_tok " what is use of it and it is for what function .

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Hi @lmjoin,

1 . Last 7 Days -7d@d , what is use of it :

On Jun 16th, you decide to run a search at 10:00

If you specify earliest=-7d, the search goes back exactly seven days, starting at 10:00 on Jun 9th.
If you specify earliest=-7d@d, the search goes back to seven days and snaps to the beginning of the day. The search looks for events starting from 00:00 on Jun 9th.

Refer Time modifiers for more information

2 . token="period_tok " what is use of it and it is for what function :

Based on the radio button selected, the value of that time modifier is assigned to the token periodtok and you could use this token in other part of the dashboard searches as a variable $periodtok$
For e.g. if you select Last 24 Hours, then periodtok will be assigned the value -24h@h and you could use this in other searches `index=your index earliest=$periodtok$`

Please refer Token Usage for further reference.

0 Karma

Explorer

Thanks for reply

Need to understand
$label$
$value$ >>>>>>>>>>>>>>. using value from $period_tok$

0 Karma

Explorer
   <set token="date_label">$label$</set>
   <set token="earliest_tok">$value$</set>
0 Karma

Explorer

using value from $period_tok$

0 Karma

SplunkTrust
SplunkTrust

For the radio input period_tok the $label$ can be used to access Label data of the radio for example Last 24 Hours and $value$ will access the Value i.e. -24h@h

 <choice value="-24h@h">Last 24 Hours</choice>

You should try to get Splunk Dashboard Examples App to try out and understand these examples and dashboard tips and tricks.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

@lmjoin , do you need any further assistance?

0 Karma

Explorer

Thanks
done

0 Karma

SplunkTrust
SplunkTrust

Hi @lmjoin,
Glad to hear. Please accept as answer to close the thread

0 Karma