need infomation about xml

[lmjoin]

in this program :-

Use tokens with input choices to capture input labels and values

Last 7 Days
-7d@d

<input type="radio" token="period_tok">
  <label>Select a time range</label>
  <choice value="-24h@h">Last 24 Hours</choice>
  <choice value="-7d@d">Last 7 Days</choice>
  <choice value="-30d@d">Last 30 Days</choice>
  <default>Last 7 Days</default>

  <change>
      <!-- use predefined input tokens to set -->
      <!-- tokens for the selected label and value -->
      <set token="date_label">$label$</set>
      <set token="earliest_tok">$value$</set>
  </change>

</input>



<panel>
  <title>Conditional Inputs</title>
  <chart>
    <!-- Display selected label in the title -->
    <title>Source Type by $date_label$</title>

    <search>
      <query>index = _internal | timechart count by sourcetype</query>
      <!-- use the value of earliest_tok -->
      <!-- to set the time range         -->
      <earliest>$earliest_tok$</earliest>
      <latest>now</latest>
    </search>

    <option name="charting.axisY.scale">log</option>
    <option name="charting.axisTitleX.text">Time period</option>
    <option name="charting.axisTitleY.text">Events</option>
  </chart>
</panel>

my question as below :-
1)
Last 7 Days
-7d@d
, what is use of it .
2) token="period_tok " what is use of it and it is for what function .

[renjith_nair]

Hi @lmjoin,

1 . Last 7 Days -7d@d , what is use of it :

On Jun 16th, you decide to run a search at 10:00

If you specify earliest=-7d, the search goes back exactly seven days, starting at 10:00 on Jun 9th.
If you specify earliest=-7d@d, the search goes back to seven days and snaps to the beginning of the day. The search looks for events starting from 00:00 on Jun 9th.

Refer Time modifiers for more information

2 . token="period_tok " what is use of it and it is for what function :

Based on the radio button selected, the value of that time modifier is assigned to the token period_tok and you could use this token in other part of the dashboard searches as a variable $period_tok$
For e.g. if you select Last 24 Hours, then period_tok will be assigned the value -24h@h and you could use this in other searches index=your index earliest=$period_tok$

Please refer Token Usage for further reference.

[lmjoin]

Thanks for reply

Need to understand
$label$
$value$ >>>>>>>>>>>>>>. using value from $period_tok$

[lmjoin]

   <set token="date_label">$label$</set>
   <set token="earliest_tok">$value$</set>

[lmjoin]

using value from $period_tok$

[niketn]

For the radio input period_tok the $label$ can be used to access Label data of the radio for example Last 24 Hours and $value$ will access the Value i.e. -24h@h

 <choice value="-24h@h">Last 24 Hours</choice>

You should try to get Splunk Dashboard Examples App to try out and understand these examples and dashboard tips and tricks.

[renjith_nair]

@lmjoin , do you need any further assistance?

[lmjoin]

Thanks
done

[renjith_nair]

Hi @lmjoin,
Glad to hear. Please accept as answer to close the thread