Splunk Enterprise

time picker

anissabnk
Path Finder

Hello,

I have a question about customising my time picker.
I'd like to display two panels, one for 24 hours and one for 1 month.
And I'd like panel 1 to be displayed when the teps selected is 24h, and the second panel to be displayed when the time picker is for the current month.

 

I tried this, but it doesn't work :

<form version="1.1" theme="light">
<label>dev_vwt_dashboards_uc47</label>
<init>
<set token="time_range">-24h@h</set>
<set token="date_connection">*</set>
<set token="time_connection">*</set>
<set token="IPAddress">*</set>
<set token="User">*</set>
<set token="AccessValidation">*</set>
</init>
<!--fieldset autoRun="false" submitButton="true">
<input type="time" token="field1" searchWhenChanged="true">
<label>Period</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset-->
<fieldset autoRun="false" submitButton="true">
<input type="dropdown" token="time_range" searchWhenChanged="true">
<label>Select Time Range</label>
<choice value="-24h@h">Last 24 hours</choice>
<!--choice value="@mon">Since Beginning of Month</choice-->
<default>Last 24 hours</default>
<!--change>
<condition value="-24h@h">
<set token="tokShowPanel1">true</set>
<unset token="tokShowPanel2"></unset>
</condition>
<condition value="@mon">
<unset token="tokShowPanel1"></unset>
<set token="tokShowPanel2">true</set>
</condition>
</change-->
</input>
</fieldset>
<row>
<panel>
<input type="text" token="date_connection" searchWhenChanged="true">
<label>date_connection</label>
<default>*</default>
<prefix>date_connection="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<input type="text" token="time_connection" searchWhenChanged="true">
<label>time_connection</label>
<default>*</default>
<prefix>time_connection="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<input type="text" token="IPAddress" searchWhenChanged="true">
<label>IPAddress</label>
<default>*</default>
<prefix>IPAddress="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<input type="text" token="User" searchWhenChanged="true">
<label>User</label>
<default>*</default>
<prefix>User="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="AccessValidation" searchWhenChanged="true">
<label>AccessValidation</label>
<default>*</default>
<prefix>AccessValidation="</prefix>
<suffix>"</suffix>
<initialValue>*</initialValue>
<choice value="*">All</choice>
<choice value="failure">failure</choice>
<choice value="success">success</choice>
<choice value="denied">denied</choice>
</input>
</panel>
</row>
<row>
<panel id="AD_Users_Authentication_last_24_hours" depends="$tokShowPanel1$">
<title>AD Users Authentication</title>
<table>
<search>
<query>|loadjob savedsearch="anissa.bannak.ext@abc.com:search:dev_vwt_saved_search_uc47_AD_Authentication_Result" |rename UserAccountName as "User" |search $date_connection$ $time_connection$ $IPAddress$ $User$ $AccessValidation$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">100</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="Last Connection Status">
<colorPalette type="map">{"failure":#D94E17,"success":#55C169}</colorPalette>
</format>
<format type="color" field="Access Validation">
<colorPalette type="map">{"success":#55C169,"failure":#D94E17}</colorPalette>
</format>
<format type="number" field="AuthenticationResult"></format>
<format type="color" field="AuthenticationResult">
<colorPalette type="map">{"failure":#D94E17,"success":#55C169}</colorPalette>
</format>
<format type="color" field="Access_Validation">
<colorPalette type="map">{"success":#55C169,"failure":#D41F1F}</colorPalette>
</format>
<format type="color" field="AccessValidation">
<colorPalette type="map">{"success":#118832,"failure":#D41F1F}</colorPalette>
</format>
<format type="color" field="last_connection_status">
<colorPalette type="map">{"success":#55C169,"failure":#D94E17}</colorPalette>
</format>
</table>
</panel>
</row>
<row>
<panel id="AD_Users_Authentication_1_month" depends="$tokShowPanel2$">
<title>AD Users Authentication</title>
<table>
<search>
<query>|loadjob savedsearch="anissa.bannak.ext@abc.com:search:dev_vwt_saved_search_uc47_AD_Authentication_Result" |rename UserAccountName as "User" |search $date_connection$ $time_connection$ $IPAddress$ $User$ $AccessValidation$</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
</search>
<option name="count">100</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<format type="color" field="Last Connection Status">
<colorPalette type="map">{"failure":#D94E17,"success":#55C169}</colorPalette>
</format>
<format type="color" field="Access Validation">
<colorPalette type="map">{"success":#55C169,"failure":#D94E17}</colorPalette>
</format>
<format type="number" field="AuthenticationResult"></format>
<format type="color" field="AuthenticationResult">
<colorPalette type="map">{"failure":#D94E17,"success":#55C169}</colorPalette>
</format>
<format type="color" field="Access_Validation">
<colorPalette type="map">{"success":#55C169,"failure":#D41F1F}</colorPalette>
</format>
<format type="color" field="AccessValidation">
<colorPalette type="map">{"success":#118832,"failure":#D41F1F}</colorPalette>
</format>
<format type="color" field="last_connection_status">
<colorPalette type="map">{"success":#55C169,"failure":#D94E17}</colorPalette>
</format>
</table>
</panel>
</row>
</form>
Labels (1)
0 Karma

marnall
Motivator

Does the time range picker need to be a time range picker? You could set it up as a dropdown with 2 options: 24h and 1month, then make 2 panels in your dashboard which each depend on a token to be set when the dropdown option is selected. Then set the panels to have searches whose <earliest> time is -24h and -1mon respectively. Only one panel will display at a time.

 

<form version="1.1" theme="dark">
  <label>2 Time Picker Dashboard</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="field1">
      <label>timerange</label>
      <choice value="1">24h</choice>
      <choice value="2">1month</choice>
      <change>
        <eval token="dp1">if($value$="1",true(),null())</eval>
        <eval token="dp2">if($value$="2",true(),null())</eval>
      </change>
      <default>1</default>
      <initialValue>1</initialValue>
    </input>
  </fieldset>
  <row depends="$dp1$">
    <panel>
      <table>
        <search>
          <query>search index=* | head 5</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
  <row depends="$dp2$">
    <panel>
      <table>
        <search>
          <query>search index=* | head 10</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...