Splunk Search

Auto run search depending two inputs.

Contributor

What I am look here is when a user selects Day-to-day or Week-to-week the dropdown options should change accordingly I am able to do that but, not my search it's not getting change with the radio input. I want my search to show default timerange depending on the option selected from the radio input.

<dashboard>
   <fieldset submitButton="false">
     <input type="radio" token="field1" searchWhenChanged="true">
       <label>field1</label>
       <choice value="Day-to-day">Day over day</choice>
       <choice value="Week-to-week">Week over week</choice>
       <default>Day-to-day</default>
       <change>
         <condition value="Day-to-day">
           <set token="Day"></set>
           <unset token="Week"></unset>
         </condition>
         <condition value="Week-to-week">
           <set token="Week"></set>
           <unset token="Day"></unset>
         </condition>
       </change>
     </input>
     <input type="dropdown" token="level_d" searchWhenChanged="true" depends="$Day$">
      <label>Pick the TimeRange:</label>
      <choice value="-7d@d">Last 7 days</choice>
      <choice value="-6d@d">Last 6 days</choice>
      <choice value="-5d@d">Last 5 days</choice>
      <choice value="-4d@d">Last 4 days</choice>
      <choice value="-3d@d">Last 3 days</choice>
      <choice value="-2d@d">Last 2 days</choice>
      <choice value="-1d@d">Yesterday to Today</choice>
      <default>-1d@d</default>
      <change>
        <condition value="-7d@d">
          <set token="s_from">-7d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">7</set>
          <set token="then">Avg count of past 7days</set>
          <set token="now">Todays count</set>
        </condition>
        <condition value="-6d@d">
          <set token="s_from">-6d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">6</set>
          <set token="then">Avg count of past 6days</set>
          <set token="now">Todays count</set>
        </condition>
        <condition value="-5d@d">
          <set token="s_from">-5d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">5</set>
          <set token="then">Avg count of past 5days</set>
          <set token="now">Todays count</set>
        </condition>
        <condition value="-4d@d">
          <set token="s_from">-4d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">4</set>
          <set token="then">Avg count of past 4days</set>
          <set token="now">Todays count</set>
        </condition>
        <condition value="-3d@d">
          <set token="s_from">-3d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">3</set>
          <set token="then">Avg count of past 3days</set>
          <set token="now">Todays count</set>
        </condition>
        <condition value="-2d@d">
          <set token="s_from">-2d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">2</set>
          <set token="then">Avg count of past 2days</set>
          <set token="now">Todays count</set>
        </condition>
        <condition value="-1d@d">
          <set token="s_from">-1d@d</set>
          <set token="relative_time">@d</set>
          <set token="Count_by">date_hour</set>
          <set token="number_days">1</set>
          <set token="then">Count of yesterday</set>
          <set token="now">Todays count</set>
        </condition>
      </change>
    </input>

      <input type="dropdown" token="level_w" searchWhenChanged="true" depends="$Week$">
      <label>Pick the TimeRange:</label>
      <choice value="-w@w1">Previous to current week</choice>
      <choice value="-2w@w1">Two weeks to current week</choice>
      <choice value="-3w@w1">Three weeks to current week</choice>
      <choice value="-4w@w1">Four weeks to current week</choice>
      <default>-w@w1</default>
      <change>
        <condition value="-w@w1">
          <set token="s_from">-w@w1</set>
          <set token="relative_time">@w1</set>
          <set token="Count_by">date_wday</set>
          <set token="number_days">1</set>
          <set token="then">Count of previous week</set>
          <set token="now">This weeks count</set>
        </condition>
        <condition value="-2w@w1">
          <set token="s_from">-2w@w1</set>
          <set token="relative_time">@w1</set>
          <set token="Count_by">date_wday</set>
          <set token="number_days">2</set>
          <set token="then">Avg count of past 2weeks</set>
          <set token="now">This weeks count</set>
        </condition>
        <condition value="-3w@w1">
          <set token="s_from">-3w@w1</set>
          <set token="relative_time">@w1</set>
          <set token="Count_by">date_wday</set>
          <set token="number_days">3</set>
          <set token="then">Avg count of past 3weeks</set>
          <set token="now">This weeks count</set>
        </condition>
        <condition value="-4w@w1">
          <set token="s_from">-4w@w1</set>
          <set token="relative_time">@w1</set>
          <set token="Count_by">date_wday</set>
          <set token="number_days">4</set>
          <set token="then">Avg count of past 4weeks</set>
          <set token="now">This weeks count</set>
        </condition>
      </change>
      </input>
   </fieldset>
   <row>
    <panel>
      <title>Total transactions</title>
      <chart>
        <search>
          <query>| multisearch 
    [ search search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=$s_from$ latest=$relative_time$ 
    | eval when="$then$"] 
    [ search sourcetype="busevt" OR sourcetype="sysout" TransactionId=TID* AND TransactionId!=TID earliest=$relative_time$ latest=@h+h 
    | eval when="$now$" ] 
| chart count by $Count_by$ when 
| eval then=round(then/$number_days$,0) 
| eval sort_field = case(date_wday=="monday", 1,
    date_wday=="tuesday", 2,
    date_wday=="wednesday", 3,
    date_wday=="thursday", 4,
    date_wday=="friday", 5,
    date_wday=="saturday", 6,
    date_wday=="sunday", 7) 
| sort 0 sort_field 
| fields - sort_field</query>
          <earliest>-2d@d</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">connect</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">top</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
   </row>
 </dashboard>
0 Karma

SplunkTrust
SplunkTrust

@sandeepmakkena seems like you have attached wrong screenshot. Can you fix the same for the community to assist you better?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma