Splunk Search

Auto run search depending two inputs.

sandeepmakkena
Contributor

What I am look here is when a user selects Day-to-day or Week-to-week the dropdown options should change accordingly I am able to do that but, not my search it's not getting change with the radio input. I want my search to show default timerange depending on the option selected from the radio input.

<dashboard>
   <fieldset submitButton="false">
     <input type="radio" token="field1" searchWhenChanged="true">
       <label>field1</label>
       <choice value="Day-to-day">Day over day</choice>
       <choice value="Week-to-week">Week over week</choice>
       <default>Day-to-day</default>
       <change>
         <condition value="Day-to-day">
           <set token="Day"></set>
           <unset token="Week"></unset>
         </condition>
         <condition value="Week-to-week">
           <set token="Week"></set>
           <unset token="Day"></unset>
         </condition>
       </change>
     </input>
     <input type="dropdown" token="level_d" searchWhenChanged="true" depends="$Day$">
      <label>Pick the TimeRange:</label>
      <choice value="-7d@d">Last 7 days</choice>
      <choice value="-6d@d">Last 6 days</choice>
      <choice value="-5d@d">Last 5 days</choice>
      <choice value="-4d@d">Last 4 days</choice>
      <choice value="-3d@d">Last 3 days</choice>
      <choice value="-2d@d">Last 2 days</choice>
      <choice value="-1d@d">Yesterday to Today</choice>
      <default>-1d@d</default>
      <change>
        <condition value="-7d@d">
          <set token="s_from">-7d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">7</set>
          <set token="then">Avg count of past 7days</set>
          <set token="now">Todays count</set>
        </condition>
        <condition value="-6d@d">
          <set token="s_from">-6d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">6</set>
          <set token="then">Avg count of past 6days</set>
          <set token="now">Todays count</set>
        </condition>
        <condition value="-5d@d">
          <set token="s_from">-5d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">5</set>
          <set token="then">Avg count of past 5days</set>
          <set token="now">Todays count</set>
        </condition>
        <condition value="-4d@d">
          <set token="s_from">-4d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">4</set>
          <set token="then">Avg count of past 4days</set>
          <set token="now">Todays count</set>
        </condition>
        <condition value="-3d@d">
          <set token="s_from">-3d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">3</set>
          <set token="then">Avg count of past 3days</set>
          <set token="now">Todays count</set>
        </condition>
        <condition value="-2d@d">
          <set token="s_from">-2d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">2</set>
          <set token="then">Avg count of past 2days</set>
          <set token="now">Todays count</set>
        </condition>
        <condition value="-1d@d">
          <set token="s_from">-1d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">1</set>
          <set token="then">Count of yesterday</set>
          <set token="now">Todays count</set>
        </condition>
      </change>
    </input>

      <input type="dropdown" token="level_w" searchWhenChanged="true" depends="$Week$">
      <label>Pick the TimeRange:</label>
      <choice value="-w@w1">Previous to current week</choice>
      <choice value="-2w@w1">Two weeks to current week</choice>
      <choice value="-3w@w1">Three weeks to current week</choice>
      <choice value="-4w@w1">Four weeks to current week</choice>
      <default>-w@w1</default>
      <change>
        <condition value="-w@w1">
          <set token="s_from">-w@w1</set>
          <set token="relative_time">@w1</set>
          <set token="Count_by">date_wday</set>
          <set token="number_days">1</set>
          <set token="then">Count of previous week</set>
          <set token="now">This weeks count</set>
        </condition>
        <condition value="-2w@w1">
          <set token="s_from">-2w@w1</set>
          <set token="relative_time">@w1</set>
          <set token="Count_by">date_wday</set>
          <set token="number_days">2</set>
          <set token="then">Avg count of past 2weeks</set>
          <set token="now">This weeks count</set>
        </condition>
        <condition value="-3w@w1">
          <set token="s_from">-3w@w1</set>
          <set token="relative_time">@w1</set>
          <set token="Count_by">date_wday</set>
          <set token="number_days">3</set>
          <set token="then">Avg count of past 3weeks</set>
          <set token="now">This weeks count</set>
        </condition>
        <condition value="-4w@w1">
          <set token="s_from">-4w@w1</set>
          <set token="relative_time">@w1</set>
          <set token="Count_by">date_wday</set>
          <set token="number_days">4</set>
          <set token="then">Avg count of past 4weeks</set>
          <set token="now">This weeks count</set>
        </condition>
      </change>
      </input>
   </fieldset>
   <row>
    <panel>
      <title>Total transactions</title>
      <chart>
        <search>
          <query>| multisearch 
    [ search search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=$s_from$ latest=$relative_time$ 
    | eval when="$then$"] 
    [ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=$relative_time$ latest=@h+h 
    | eval when="$now$" ] 
| chart count by $Count_by$ when 
| eval then=round(then/$number_days$,0) 
| eval sort_field = case(date_wday=="monday", 1,
    date_wday=="tuesday", 2,
    date_wday=="wednesday", 3,
    date_wday=="thursday", 4,
    date_wday=="friday", 5,
    date_wday=="saturday", 6,
    date_wday=="sunday", 7) 
| sort 0 sort_field 
| fields - sort_field</query>
          <earliest>-2d@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">connect</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">top</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
   </row>
 </dashboard>
0 Karma

niketn
Legend

@sandeepmakkena seems like you have attached wrong screenshot. Can you fix the same for the community to assist you better?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...