Hi,
I created a filter with all the months taken from the "SCOPE" field.
this contains 12 months back, in the dashboard I can have all the months written in Italian.
Now I would like the default to be the month prior to today.
I tried with
<default> $ A_data $ </default>
<choice value = "$ A_data $"> PREVIOUS_MONTH </choice>
but it does not work.
I would like it to be selected by Default (if today we are in April, "MARCH-2021" was selected)
Tks
Bye
Antonio
------ source -------
<form hideFilters="true">
<label> Results and Details: Web survey</label>
<fieldset submitButton="false">
<input type="dropdown" token="field1">
<label>Mese</label>
<fieldForLabel>field1</fieldForLabel>
<fieldForValue>AMBITO</fieldForValue>
<search>
<query>index=aladin * sourcetype=cruscotto_tnps
|search ZONA ="Totale"
|eval anno=mvindex(split(AMBITO,"-"),1)
|eval mese=mvindex(split(AMBITO,"-"),0)
| eval mesi=case(
mese="Gennaio","01",
mese="Febbraio","02",
mese="Marzo","03",
mese="Aprile","04",
mese="Maggio","05",
mese="Giugno","06",
mese="Luglio","07",
mese="Agosto","08",
mese="Settembre","09",
mese="Ottobre","10",
mese="Novembre","11",
mese="Dicembre","12",
1=1, "INV")
|eval OrdineAmbito = anno.mesi
|sort OrdineAmbito
| eval A_mese=strftime(relative_time(now(), "-30d@d"),"%m")
| eval A_anno=strftime(relative_time(now(), "-30d@d"),"%Y")
| eval A_mesi=case(
A_mese="01","Gennaio",
A_mese="02","Febbraio",
A_mese="03","Marzo",
A_mese="04","Aprile",
A_mese="05","Maggio",
A_mese="06","Giugno",
A_mese="07","Luglio",
A_mese="08","Agosto",
A_mese="09","Settembre",
A_mese="10","Ottobre",
A_mese="11","Novembre",
A_mese="12","Dicembre",
1=1, "INV")
|eval A_data= A_mesi."-".A_anno
|table AMBITO,A_data</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<default>$A_data$</default>
<choice value="$A_data$">MESE_PRECEDENTE</choice>
</input>
</fieldset>
<row>
<panel>
<html>
<div style="height: 2em; display: flex; align-items: center; justify-content: center;color:blue;font-style:bold;font-size:200%">
<B> $field1$</B>
</div>
</html>
</panel>
</row>
<row>
<panel>
<html>
</html>
</panel>
</row>
<row>
<panel>
<single>
<title>T-PRO</title>
<search>
<query>index=aladin * sourcetype=cruscotto_tnps
|search ZONA ="Totale"
|eval anno = strftime(_time,"%Y")
| eval mesi=strftime(_time,"%m")
| eval mese=case(
mesi="01","Gennaio-",
mesi="02","Febbraio-",
mesi="03","Marzo-",
mesi="04","Aprile-",
mesi="05","Maggio-",
mesi="06","giugno-",
mesi="07","Luglio-",
mesi="08","Agosto-",
mesi="09","Settembre-",
mesi="10","Ottobre-",
mesi="11","Novembre",
mesi="12","Dicembre-",
1=1, "INV")
|eval meseanno= mese.anno
|where AMBITO = "$field1$"
|sort ZONA
|fields T_PRO
|stats values(T_PRO)</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="height">50</option>
<option name="rangeColors">["0x006d9c","0x53a051"]</option>
<option name="rangeValues">[500]</option>
<option name="refresh.display">none</option>
<option name="useColors">1</option>
</single>
</panel>
The fieldForLabel and fieldForValue elements are the names of fields from your search query - your search query might return multiple rows for the same month depending on your data. Your could try something like this
<input type="dropdown" token="month">
<label>Past 12 months</label>
<search>
<query>| makeresults
| eval month=mvrange(1, 13)
| mvexpand month
| eval month=0-month
| eval _time=relative_time(_time,month."mon@mon")
| eval AMBITO=strftime(_time,"%Y-%m")
| eval mesi=strftime(_time,"%m")
| eval A_data=case(mesi="01","Gennaio-",
mesi="02","Febbraio-",
mesi="03","Marzo-",
mesi="04","Aprile-",
mesi="05","Maggio-",
mesi="06","giugno-",
mesi="07","Luglio-",
mesi="08","Agosto-",
mesi="09","Settembre-",
mesi="10","Ottobre-",
mesi="11","Novembre",
mesi="12","Dicembre-").strftime(_time,"%Y")
| table AMBITO A_data|</query>
<done>
<set token="default">$results.AMBITO$</set>
</done>
</search>
<fieldForLabel>A_data</fieldForLabel>
<fieldForValue>AMBITO</fieldForValue>
<selectFirstChoice>true</selectFirstChoice>
</input>
The fieldForLabel and fieldForValue elements are the names of fields from your search query - your search query might return multiple rows for the same month depending on your data. Your could try something like this
<input type="dropdown" token="month">
<label>Past 12 months</label>
<search>
<query>| makeresults
| eval month=mvrange(1, 13)
| mvexpand month
| eval month=0-month
| eval _time=relative_time(_time,month."mon@mon")
| eval AMBITO=strftime(_time,"%Y-%m")
| eval mesi=strftime(_time,"%m")
| eval A_data=case(mesi="01","Gennaio-",
mesi="02","Febbraio-",
mesi="03","Marzo-",
mesi="04","Aprile-",
mesi="05","Maggio-",
mesi="06","giugno-",
mesi="07","Luglio-",
mesi="08","Agosto-",
mesi="09","Settembre-",
mesi="10","Ottobre-",
mesi="11","Novembre",
mesi="12","Dicembre-").strftime(_time,"%Y")
| table AMBITO A_data|</query>
<done>
<set token="default">$results.AMBITO$</set>
</done>
</search>
<fieldForLabel>A_data</fieldForLabel>
<fieldForValue>AMBITO</fieldForValue>
<selectFirstChoice>true</selectFirstChoice>
</input>
Excellent !!!
It works perfectly and even the months are sorted from largest to smallest.
I had ordered with YEAR-MONTH to have 2021-04,2021-03, etc ...... but this is better.
In addition, SCOPE contains the values of the 12 months prior to today for which from April-2021 to April-2020.
Actually I don't need A_data, I just need SCOPE, to query the charts.
now I have to see what you did to understand the concept well
thank you very much, you were really great !!!
Bye
Antonio
I only need this queru to transform the values of the SCOPE field in Italian language:
Ottobre-2020
Novembre-2020
.
.
Febbraio-2021
Marzo-2021
Aprile-2021
There are no other data, I then take the data in the chart query where I use the $ filed1 $ variable obtained from the chosen month.
I want it to be the month before today by default.
I'll try your suggestion right away and let you know how it went 🙂
Tks
Bye
Antonio
<input type="dropdown" token="field1">
<label>Mese</label>
<fieldForLabel>A_data</fieldForLabel>
<fieldForValue>AMBITO</fieldForValue>
<search>
<query>index=idx sourcetype=source
|search ZONA ="Totale"
|eval anno=mvindex(split(AMBITO,"-"),1)
|eval mese=mvindex(split(AMBITO,"-"),0)
| eval mesi=case(
mese="Gennaio","01",
mese="Febbraio","02",
mese="Marzo","03",
mese="Aprile","04",
mese="Maggio","05",
mese="Giugno","06",
mese="Luglio","07",
mese="Agosto","08",
mese="Settembre","09",
mese="Ottobre","10",
mese="Novembre","11",
mese="Dicembre","12",
1=1, "INV")
|eval OrdineAmbito = anno.mesi
|sort - OrdineAmbito
|eval A_data= mese."-".anno
| append [| makeresults
| eval A_data="MESE_PRECEDENTE"]
| streamstats count as row
| eventstats values(eval(if(row=2,AMBITO,null))) as second
| eval AMBIIO=if(A_data="MESE_PRECEDENTE",second." ",AMBITO)
| table AMBITO A_data second</query>
<done>
<set token="default">$result.second$</set>
</done>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<default>$default$</default>
</input>
When the field1 token is used, it should be trimmed due to the extra space added to avoid duplication of values.