Splunk Enterprise

time picker

anissabnk
Path Finder

Hello,

I have a question about customising my time picker.
I'd like to display two panels, one for 24 hours and one for 1 month.
And I'd like panel 1 to be displayed when the teps selected is 24h, and the second panel to be displayed when the time picker is for the current month.

 

I tried this, but it doesn't work :

<form version="1.1" theme="light">
<label>dev_vwt_dashboards_uc47</label>
<init>
<set token="time_range">-24h@h</set>
<set token="date_connection">*</set>
<set token="time_connection">*</set>
<set token="IPAddress">*</set>
<set token="User">*</set>
<set token="AccessValidation">*</set>
</init>
<!--fieldset autoRun="false" submitButton="true">
<input type="time" token="field1" searchWhenChanged="true">
<label>Period</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset-->
<fieldset autoRun="false" submitButton="true">
<input type="dropdown" token="time_range" searchWhenChanged="true">
<label>Select Time Range</label>
<choice value="-24h@h">Last 24 hours</choice>
<!--choice value="@mon">Since Beginning of Month</choice-->
<default>Last 24 hours</default>
<!--change>
<condition value="-24h@h">
<set token="tokShowPanel1">true</set>
<unset token="tokShowPanel2"></unset>
</condition>
<condition value="@mon">
<unset token="tokShowPanel1"></unset>
<set token="tokShowPanel2">true</set>
</condition>
</change-->
</input>
</fieldset>
<row>
<panel>
<input type="text" token="date_connection" searchWhenChanged="true">
<label>date_connection</label>
<default>*</default>
<prefix>date_connection="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<input type="text" token="time_connection" searchWhenChanged="true">
<label>time_connection</label>
<default>*</default>
<prefix>time_connection="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<input type="text" token="IPAddress" searchWhenChanged="true">
<label>IPAddress</label>
<default>*</default>
<prefix>IPAddress="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<input type="text" token="User" searchWhenChanged="true">
<label>User</label>
<default>*</default>
<prefix>User="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="AccessValidation" searchWhenChanged="true">
<label>AccessValidation</label>
<default>*</default>
<prefix>AccessValidation="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
<choice value="*">All</choice>
<choice value="failure">failure</choice>
<choice value="success">success</choice>
<choice value="denied">denied</choice>
</input>
</panel>
</row>
<row>
<panel id="AD_Users_Authentication_last_24_hours" depends="$tokShowPanel1$">
<title>AD Users Authentication</title>
<table>
<search>
<query>|loadjob savedsearch="[email protected]:search:dev_vwt_saved_search_uc47_AD_Authentication_Result" |rename UserAccountName as "User" |search $date_connection$ $time_connection$ $IPAddress$ $User$ $AccessValidation$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">100</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="Last Connection Status">
<colorPalette type="map">{"failure":#D94E17,"success":#55C169}</colorPalette>
</format>
<format type="color" field="Access Validation">
<colorPalette type="map">{"success":#55C169,"failure":#D94E17}</colorPalette>
</format>
<format type="number" field="AuthenticationResult"></format>
<format type="color" field="AuthenticationResult">
<colorPalette type="map">{"failure":#D94E17,"success":#55C169}</colorPalette>
</format>
<format type="color" field="Access_Validation">
<colorPalette type="map">{"success":#55C169,"failure":#D41F1F}</colorPalette>
</format>
<format type="color" field="AccessValidation">
<colorPalette type="map">{"success":#118832,"failure":#D41F1F}</colorPalette>
</format>
<format type="color" field="last_connection_status">
<colorPalette type="map">{"success":#55C169,"failure":#D94E17}</colorPalette>
</format>
</table>
</panel>
</row>
<row>
<panel id="AD_Users_Authentication_1_month" depends="$tokShowPanel2$">
<title>AD Users Authentication</title>
<table>
<search>
<query>|loadjob savedsearch="[email protected]:search:dev_vwt_saved_search_uc47_AD_Authentication_Result" |rename UserAccountName as "User" |search $date_connection$ $time_connection$ $IPAddress$ $User$ $AccessValidation$</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
<option name="count">100</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="Last Connection Status">
<colorPalette type="map">{"failure":#D94E17,"success":#55C169}</colorPalette>
</format>
<format type="color" field="Access Validation">
<colorPalette type="map">{"success":#55C169,"failure":#D94E17}</colorPalette>
</format>
<format type="number" field="AuthenticationResult"></format>
<format type="color" field="AuthenticationResult">
<colorPalette type="map">{"failure":#D94E17,"success":#55C169}</colorPalette>
</format>
<format type="color" field="Access_Validation">
<colorPalette type="map">{"success":#55C169,"failure":#D41F1F}</colorPalette>
</format>
<format type="color" field="AccessValidation">
<colorPalette type="map">{"success":#118832,"failure":#D41F1F}</colorPalette>
</format>
<format type="color" field="last_connection_status">
<colorPalette type="map">{"success":#55C169,"failure":#D94E17}</colorPalette>
</format>
</table>
</panel>
</row>
</form>
Labels (1)
0 Karma

marnall
Motivator

Does the time range picker need to be a time range picker? You could set it up as a dropdown with 2 options: 24h and 1month, then make 2 panels in your dashboard which each depend on a token to be set when the dropdown option is selected. Then set the panels to have searches whose <earliest> time is -24h and -1mon respectively. Only one panel will display at a time.

 

<form version="1.1" theme="dark">
  <label>2 Time Picker Dashboard</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>timerange</label>
      <choice value="1">24h</choice>
      <choice value="2">1month</choice>
      <change>
        <eval token="dp1">if($value$="1",true(),null())</eval>
        <eval token="dp2">if($value$="2",true(),null())</eval>
      </change>
      <default>1</default>
      <initialValue>1</initialValue>
    </input>
  </fieldset>
  <row depends="$dp1$">
    <panel>
      <table>
        <search>
          <query>search index=* | head 5</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row depends="$dp2$">
    <panel>
      <table>
        <search>
          <query>search index=* | head 10</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Build and Launch AI Agents from Your Splunk Workflows

  Register We’ve all been there: juggling alerts, runbooks, and endless manual searches. What if you could ...

Splunk Cloud Application Management in Terraform

Register   On Tuesday, August 4 at 11AM PDT / 2PM EDT, we’re diving into how you can bring Infrastructure as ...

Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...