Splunk Search

How to create a conditional graph depending on input parameter?

jinishshah
Explorer

Hello,

so I have an input on my dashboard page of either month"01-2022,02-2022" and also quarter"Q1-2022". So depending on the search I want to have my timechart command.

For example: query| timechart span="1mon" count(number) [For month]
query| timechart span="qtr" count(number) [For quarter].

I want query like this:

if [input_month="Q%"] then

query| timechart span="qtr" count(number)

else

query| timechart span="1mon" count(number)

 

How can I do this  ?

Labels (1)
0 Karma

jinishshah
Explorer

Also I need the values "Q1-2022","01-2022","03-2022" for other calculation so cannot change Token value keeping the Token Label as  "Q1-2022","01-2022","03-2022"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set up a dropdown with the options and use the token in the search query

query| timechart span=$span$ count(number)
0 Karma

jinishshah
Explorer

@ITWhisperer : Token Input is "Q1-2022" which needs to be interpreted as "qtr" while same Token input if "01-2022","02-2022" needs to be interpreted as "1mon" so cannot directly pass $span$

tried below:

eval span_time=if(input="Q%","qtr","1mon")

| timechart span=span_time count(number)

 

but gives an error "Error in 'timechart' command: The value for option span (jinmonth) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value."

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How have you defined your "input"?

Can you add a change handler to set an additional token based on the value chosen?

0 Karma

jinishshah
Explorer

Input is defined as Dropdown:

Label   Value

Q1-2022   "Q1-2022"

01-2022   "01-2022"

02-2022   "02-2022"

and I am using this Token values for other calculations

0 Karma

jinishshah
Explorer

@ITWhisperer Also I need the values "Q1-2022","01-2022","03-2022" for other calculation so cannot change Token value keeping the Token Label as  "Q1-2022","01-2022","03-2022"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As I said, you could use a change handler in the input

    <input type="dropdown" token="monthquarter" searchWhenChanged="true">
      <label>Month/quarter span $monthquarterspan$</label>
      <choice value="Q1-2022">Q1-2022</choice>
      <choice value="01-2022">01-2022</choice>
      <choice value="02-2022">02-2022</choice>
      <default>Q1-2022</default>
      <change>
        <eval token="monthquarterspan">if(substr($monthquarter$,1,1)="Q","qtr","1mon")</eval>
      </change>
    </input>
0 Karma

jinishshah
Explorer

@ITWhisperer : what is the syntax for Dashboard Studio. This seems to be syntax for Classic Dashboard.

Syntax format of Dashboard Studio is like below:

    "inputs": {
        "input_month-year": {
            "options": {
                "items": [
                    {
                        "label": "Q1-2022",
                        "value": "\"Q1-2022\""
                    },
                    {
                        "label": "01-2022",
                        "value": "\"01-2022\""
                    },
                    {
                        "label": "02-2022",
                        "value": "\"02-2022\""
                    },
                    {
                        "label": "03-2022",
                        "value": "\"03-2022\""
                    }
                ],
                "token": "month_year"
            },
            "title": "Month-Year",
            "type": "input.dropdown"
        },
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Correct - just one of the reasons I don't use Studio for serious dashboards (yet)

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...