Dashboards & Visualizations

need infomation about xml

lmjoin
Explorer

in this program :-

Use tokens with input choices to capture input labels and values

Last 7 Days
-7d@d

<input type="radio" token="period_tok">
  <label>Select a time range</label>
  <choice value="-24h@h">Last 24 Hours</choice>
  <choice value="-7d@d">Last 7 Days</choice>
  <choice value="-30d@d">Last 30 Days</choice>
  <default>Last 7 Days</default>

  <change>
      <!-- use predefined input tokens to set -->
      <!-- tokens for the selected label and value -->
      <set token="date_label">$label$</set>
      <set token="earliest_tok">$value$</set>
  </change>

</input>



<panel>
  <title>Conditional Inputs</title>
  <chart>
    <!-- Display selected label in the title -->
    <title>Source Type by $date_label$</title>

    <search>
      <query>index = _internal | timechart count by sourcetype</query>
      <!-- use the value of earliest_tok -->
      <!-- to set the time range         -->
      <earliest>$earliest_tok$</earliest>
      <latest>now</latest>
    </search>

    <option name="charting.axisY.scale">log</option>
    <option name="charting.axisTitleX.text">Time period</option>
    <option name="charting.axisTitleY.text">Events</option>
  </chart>
</panel>

my question as below :-
1)
Last 7 Days
-7d@d
, what is use of it .
2) token="period_tok " what is use of it and it is for what function .

Tags (2)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @lmjoin,

1 . Last 7 Days -7d@d , what is use of it :

On Jun 16th, you decide to run a search at 10:00

If you specify earliest=-7d, the search goes back exactly seven days, starting at 10:00 on Jun 9th.
If you specify earliest=-7d@d, the search goes back to seven days and snaps to the beginning of the day. The search looks for events starting from 00:00 on Jun 9th.

Refer Time modifiers for more information

2 . token="period_tok " what is use of it and it is for what function :

Based on the radio button selected, the value of that time modifier is assigned to the token period_tok and you could use this token in other part of the dashboard searches as a variable $period_tok$
For e.g. if you select Last 24 Hours, then period_tok will be assigned the value -24h@h and you could use this in other searches index=your index earliest=$period_tok$

Please refer Token Usage for further reference.

Happy Splunking!
0 Karma

lmjoin
Explorer

Thanks for reply

Need to understand
$label$
$value$ >>>>>>>>>>>>>>. using value from $period_tok$

0 Karma

lmjoin
Explorer
   <set token="date_label">$label$</set>
   <set token="earliest_tok">$value$</set>
0 Karma

lmjoin
Explorer

using value from $period_tok$

0 Karma

niketn
Legend

For the radio input period_tok the $label$ can be used to access Label data of the radio for example Last 24 Hours and $value$ will access the Value i.e. -24h@h

 <choice value="-24h@h">Last 24 Hours</choice>

You should try to get Splunk Dashboard Examples App to try out and understand these examples and dashboard tips and tricks.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@lmjoin , do you need any further assistance?

Happy Splunking!
0 Karma

lmjoin
Explorer

Thanks
done

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Hi @lmjoin,
Glad to hear. Please accept as answer to close the thread

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...