Splunk Enterprise

How to apply time filter for today, last month, and last quarter in Splunk dashboard?

Lavender
Loves-to-Learn Everything

Hi,

I have a requirement to show the data based on period . Period is a dropdown having Today,Last Month & Last Quarter. Based on this filter panel should refresh . 

My query is  

<input type="dropdown" token="period_tkn">
<label>Period</label>
<choice value="Today">Today</choice>
<choice value="Last Month">Last Month</choice>
<choice value="Last Quarter">Last Quarter</choice>
<change>
<condition value="Today">
<set token="er">"@d"</set>
<set token="lt">now()</set>
</condition>
<condition value="Last Month">
<set token="er">"-1mon@mon"</set>
<set token="lt">"@mon"</set>
</condition>
<condition value="Last Quarter">
<set token="er">"-3mon@mon"</set>
<set token="lt">"@mon"</set>
</condition>
</change>
<default>Today</default>
<initialValue>Today</initialValue>
</input>

<table>
<search>
<query>

index="index name" earliest=$er$ 
| where _time&lt;$lt$ AND _time&gt;relative_time(now(),$er$)
| table infra_on_prem app_name platform_name _time
| timechart limit=0 span=1h min(infra_on_prem) by platform_name
| eval hour=strftime(_time,"%H"),hour=_time."#".hour.":00"
| fields - _time
| transpose 0 header_field=hour column_name=Platform
| search Platform!="_span"
| addtotals
| eval Health=case(Total&gt;20,"100:::",Total&lt;1,"500:::",1=1,"300:::")
| fields Platform Health *
| `icon_indicator_stack`
| fields - Total
| transpose header_field=Platform
| rex field=column "#(?&lt;hour&gt;.*)"
| fields - column
| transpose 0 header_field=hour column_name=Platform
| rename "row "1 as Health

 

above query is for period="Today",  bolded query condition should change based on period filter . How can I do that . please help

Labels (2)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...