Splunk Search

How do I preset two separte time span as form input?

BinnyK
Explorer

I have some research data on a dashabord. The data I want to highlight is in two separate time spans Jan 1 - Jan 30 and Mar 20 - Apr 21. I want to have two radio buttons which presets these two ranges as (span 1 and span 2) rather than asking the visitors to change to these exact dates to view these results.
How can I do this?

Tags (1)
0 Karma
1 Solution

adonio
Ultra Champion

Hi BinnyK,
here is a sample code with 2 inputs, 1 for amount of events and other with radio for the span
used the earliest and latest as values to the token
more on time modifiers, here: https://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/SearchTimeModifiers

<form>
  <label>Header</label>
  <fieldset submitButton="false">
    <input type="text" token="field2" searchWhenChanged="true">
      <label>Enter Count of Events</label>
    </input>
    <input type="radio" token="SPAN" searchWhenChanged="true">
      <label>Span</label>
      <choice value="earliest=@y latest=@y+30d">span1</choice>
      <choice value="earliest=&quot;03/20/2017:00:00:00&quot; latest=&quot;04/21/2017:00:00:00&quot;">span2</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Head $field2$ Events by Sourcetype</title>
      <chart>
        <search>
          <query>$SPAN$ index = _internal  | head $field2$ | stats count by sourcetype</query>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
  </row>
</form>

hope it helps

View solution in original post

adonio
Ultra Champion

Hi BinnyK,
here is a sample code with 2 inputs, 1 for amount of events and other with radio for the span
used the earliest and latest as values to the token
more on time modifiers, here: https://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/SearchTimeModifiers

<form>
  <label>Header</label>
  <fieldset submitButton="false">
    <input type="text" token="field2" searchWhenChanged="true">
      <label>Enter Count of Events</label>
    </input>
    <input type="radio" token="SPAN" searchWhenChanged="true">
      <label>Span</label>
      <choice value="earliest=@y latest=@y+30d">span1</choice>
      <choice value="earliest=&quot;03/20/2017:00:00:00&quot; latest=&quot;04/21/2017:00:00:00&quot;">span2</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Head $field2$ Events by Sourcetype</title>
      <chart>
        <search>
          <query>$SPAN$ index = _internal  | head $field2$ | stats count by sourcetype</query>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
  </row>
</form>

hope it helps

BinnyK
Explorer

Thanks @adonio.
That was exactly what i was looking for. That helped a lot.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...