Splunk Enterprise Security

Can you help me create a dashboard with field dependency and action state modifications?

JeffBothel
Explorer

I am attempting to create a dashboard that has a couple input fields with one being dependent on the other.

The independent field will be a drop down to select a value that will then set the time frame for a search to a specific set and disable the use of the other field. There will be a custom selection in the drop down menu that would then set a default value and enable the time input field for utilization. I would like to have the drop-down change the token values for the time picker field so that I have one reference point for time information in the search. I have been working with the drop-down condition items and have yet to create a working solution and I was wondering if someone might have some suggestions. Here is what I have thus far:

<input type="dropdown" token="shift_select" searchWhenChanged="true">
      <label>Shift for Reporting</label>
      <choice value="Shft1">Shift 1</choice>
      <choice value="Shft2">Shift 2</choice>
      <choice value="Shft3">Shift 3</choice>
      <choice value="Custom">Custom</choice>
      <change>
        <condition value="Shft1">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-24h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
        <condition value="Shft2">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-48h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
        <condition value="Shft3">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-72h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
        <condition value="Custom">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-12h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
      </change>
    </input
0 Karma

Vijeta
Influencer

I am not very clear about the requirement, but what I understand is based on dropdown selection token will be set with earliest and latest time values.

In your search query in dashboard you can use-

<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...