Splunk Search

How to create a conditional graph depending on input parameter?

jinishshah
Explorer

Hello,

so I have an input on my dashboard page of either month"01-2022,02-2022" and also quarter"Q1-2022". So depending on the search I want to have my timechart command.

For example: query| timechart span="1mon" count(number) [For month]
query| timechart span="qtr" count(number) [For quarter].

I want query like this:

if [input_month="Q%"] then

query| timechart span="qtr" count(number)

else

query| timechart span="1mon" count(number)

 

How can I do this  ?

Labels (1)
0 Karma

jinishshah
Explorer

Also I need the values "Q1-2022","01-2022","03-2022" for other calculation so cannot change Token value keeping the Token Label as  "Q1-2022","01-2022","03-2022"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set up a dropdown with the options and use the token in the search query

query| timechart span=$span$ count(number)
0 Karma

jinishshah
Explorer

@ITWhisperer : Token Input is "Q1-2022" which needs to be interpreted as "qtr" while same Token input if "01-2022","02-2022" needs to be interpreted as "1mon" so cannot directly pass $span$

tried below:

eval span_time=if(input="Q%","qtr","1mon")

| timechart span=span_time count(number)

 

but gives an error "Error in 'timechart' command: The value for option span (jinmonth) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value."

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How have you defined your "input"?

Can you add a change handler to set an additional token based on the value chosen?

0 Karma

jinishshah
Explorer

Input is defined as Dropdown:

Label   Value

Q1-2022   "Q1-2022"

01-2022   "01-2022"

02-2022   "02-2022"

and I am using this Token values for other calculations

0 Karma

jinishshah
Explorer

@ITWhisperer Also I need the values "Q1-2022","01-2022","03-2022" for other calculation so cannot change Token value keeping the Token Label as  "Q1-2022","01-2022","03-2022"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As I said, you could use a change handler in the input

    <input type="dropdown" token="monthquarter" searchWhenChanged="true">
      <label>Month/quarter span $monthquarterspan$</label>
      <choice value="Q1-2022">Q1-2022</choice>
      <choice value="01-2022">01-2022</choice>
      <choice value="02-2022">02-2022</choice>
      <default>Q1-2022</default>
      <change>
        <eval token="monthquarterspan">if(substr($monthquarter$,1,1)="Q","qtr","1mon")</eval>
      </change>
    </input>
0 Karma

jinishshah
Explorer

@ITWhisperer : what is the syntax for Dashboard Studio. This seems to be syntax for Classic Dashboard.

Syntax format of Dashboard Studio is like below:

    "inputs": {
        "input_month-year": {
            "options": {
                "items": [
                    {
                        "label": "Q1-2022",
                        "value": "\"Q1-2022\""
                    },
                    {
                        "label": "01-2022",
                        "value": "\"01-2022\""
                    },
                    {
                        "label": "02-2022",
                        "value": "\"02-2022\""
                    },
                    {
                        "label": "03-2022",
                        "value": "\"03-2022\""
                    }
                ],
                "token": "month_year"
            },
            "title": "Month-Year",
            "type": "input.dropdown"
        },
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Correct - just one of the reasons I don't use Studio for serious dashboards (yet)

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...