Splunk Search

How to create a conditional graph depending on input parameter?

jinishshah
Explorer

Hello,

so I have an input on my dashboard page of either month"01-2022,02-2022" and also quarter"Q1-2022". So depending on the search I want to have my timechart command.

For example: query| timechart span="1mon" count(number) [For month]
query| timechart span="qtr" count(number) [For quarter].

I want query like this:

if [input_month="Q%"] then

query| timechart span="qtr" count(number)

else

query| timechart span="1mon" count(number)

 

How can I do this  ?

Labels (1)
0 Karma

jinishshah
Explorer

Also I need the values "Q1-2022","01-2022","03-2022" for other calculation so cannot change Token value keeping the Token Label as  "Q1-2022","01-2022","03-2022"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Set up a dropdown with the options and use the token in the search query

query| timechart span=$span$ count(number)
0 Karma

jinishshah
Explorer

@ITWhisperer : Token Input is "Q1-2022" which needs to be interpreted as "qtr" while same Token input if "01-2022","02-2022" needs to be interpreted as "1mon" so cannot directly pass $span$

tried below:

eval span_time=if(input="Q%","qtr","1mon")

| timechart span=span_time count(number)

 

but gives an error "Error in 'timechart' command: The value for option span (jinmonth) is invalid. When span is expressed using a sub-second unit (ds, cs, ms, us), the span value needs to be < 1 second, and 1 second must be evenly divisible by the span value."

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How have you defined your "input"?

Can you add a change handler to set an additional token based on the value chosen?

0 Karma

jinishshah
Explorer

Input is defined as Dropdown:

Label   Value

Q1-2022   "Q1-2022"

01-2022   "01-2022"

02-2022   "02-2022"

and I am using this Token values for other calculations

0 Karma

jinishshah
Explorer

@ITWhisperer Also I need the values "Q1-2022","01-2022","03-2022" for other calculation so cannot change Token value keeping the Token Label as  "Q1-2022","01-2022","03-2022"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As I said, you could use a change handler in the input

    <input type="dropdown" token="monthquarter" searchWhenChanged="true">
      <label>Month/quarter span $monthquarterspan$</label>
      <choice value="Q1-2022">Q1-2022</choice>
      <choice value="01-2022">01-2022</choice>
      <choice value="02-2022">02-2022</choice>
      <default>Q1-2022</default>
      <change>
        <eval token="monthquarterspan">if(substr($monthquarter$,1,1)="Q","qtr","1mon")</eval>
      </change>
    </input>
0 Karma

jinishshah
Explorer

@ITWhisperer : what is the syntax for Dashboard Studio. This seems to be syntax for Classic Dashboard.

Syntax format of Dashboard Studio is like below:

    "inputs": {
        "input_month-year": {
            "options": {
                "items": [
                    {
                        "label": "Q1-2022",
                        "value": "\"Q1-2022\""
                    },
                    {
                        "label": "01-2022",
                        "value": "\"01-2022\""
                    },
                    {
                        "label": "02-2022",
                        "value": "\"02-2022\""
                    },
                    {
                        "label": "03-2022",
                        "value": "\"03-2022\""
                    }
                ],
                "token": "month_year"
            },
            "title": "Month-Year",
            "type": "input.dropdown"
        },
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Correct - just one of the reasons I don't use Studio for serious dashboards (yet)

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...