Splunk Enterprise Security

Can you help me create a dashboard with field dependency and action state modifications?

JeffBothel
Explorer

I am attempting to create a dashboard that has a couple input fields with one being dependent on the other.

The independent field will be a drop down to select a value that will then set the time frame for a search to a specific set and disable the use of the other field. There will be a custom selection in the drop down menu that would then set a default value and enable the time input field for utilization. I would like to have the drop-down change the token values for the time picker field so that I have one reference point for time information in the search. I have been working with the drop-down condition items and have yet to create a working solution and I was wondering if someone might have some suggestions. Here is what I have thus far:

<input type="dropdown" token="shift_select" searchWhenChanged="true">
      <label>Shift for Reporting</label>
      <choice value="Shft1">Shift 1</choice>
      <choice value="Shft2">Shift 2</choice>
      <choice value="Shft3">Shift 3</choice>
      <choice value="Custom">Custom</choice>
      <change>
        <condition value="Shft1">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-24h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
        <condition value="Shft2">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-48h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
        <condition value="Shft3">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-72h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
        <condition value="Custom">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-12h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
      </change>
    </input
0 Karma

Vijeta
Influencer

I am not very clear about the requirement, but what I understand is based on dropdown selection token will be set with earliest and latest time values.

In your search query in dashboard you can use-

<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...