Deployment Architecture
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

how to get the month dropdown?

avneet26
Engager
‎12-02-2020 10:37 PM

i want to create a dropdown in my dashboarrd where in i can select the month from the current year and it should give em the results based on the events generated in that parrticular month only. How can i do that? and how to pas the token value into my tables in the dashboard?

Labels (1)
Labels
0 Karma
Reply

somesoni2
Revered Legend
‎12-05-2020 08:47 AM

Take a look at this runanywhere dashboard code. The dropdown month will have all the month for current year (calculated based on today). The "<change>" will generate time range tokens which can be used in panel like shown.

 

 

<form>
  <label>TEST</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="month" searchWhenChanged="true">
      <label>month</label>
      <fieldForLabel>month</fieldForLabel>
      <fieldForValue>firstDayOfMonth</fieldForValue>
      <search>
        <query>|  makeresults 
|  eval month=mvrange(1,tonumber(strftime(now(),"%m"))) 
|  mvexpand month  
| eval firstDayOfMonth=strptime("01/".month."/".strftime(now(),"%Y"),"%d/%m/%Y") 
|  eval month=strftime(firstDayOfMonth,"%B")</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <change>
        <!-- use predefined input tokens to set -->
        <!-- tokens for the selected label and value -->
        <set token="earliest_tok">$value$</set>
        <eval token="latest_tok">relative_time($value$,"+1mon@mon")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>|  makeresults | addinfo | eval message="Selected results for duration ".strftime(info_min_time,"%F %T")." to ".strftime(info_max_time,"%F %T")</query>
          <earliest>$earliest_tok$</earliest>
          <latest>$latest_tok$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

  

Reply

to4kawa
Ultra Champion
‎12-04-2020 11:26 PM 
<form>
  <label>dropdown token</label>
  <fieldset>
    <input type="dropdown" token="month_token">
      <label>tokens</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>month</fieldForValue>
      <search>
        <query>| makeresults
| eval month=strftime(_time,"%B")
| eval label=month</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <p>
          <h2>drop down: $month_token$</h2>
        </p>
      </html>
    </panel>
  </row>
</form>
0 Karma
Reply
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...