Splunk Enterprise Security

Can you help me create a dashboard with field dependency and action state modifications?

JeffBothel
Explorer

I am attempting to create a dashboard that has a couple input fields with one being dependent on the other.

The independent field will be a drop down to select a value that will then set the time frame for a search to a specific set and disable the use of the other field. There will be a custom selection in the drop down menu that would then set a default value and enable the time input field for utilization. I would like to have the drop-down change the token values for the time picker field so that I have one reference point for time information in the search. I have been working with the drop-down condition items and have yet to create a working solution and I was wondering if someone might have some suggestions. Here is what I have thus far:

<input type="dropdown" token="shift_select" searchWhenChanged="true">
      <label>Shift for Reporting</label>
      <choice value="Shft1">Shift 1</choice>
      <choice value="Shft2">Shift 2</choice>
      <choice value="Shft3">Shift 3</choice>
      <choice value="Custom">Custom</choice>
      <change>
        <condition value="Shft1">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-24h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
        <condition value="Shft2">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-48h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
        <condition value="Shft3">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-72h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
        <condition value="Custom">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-12h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
      </change>
    </input
0 Karma

Vijeta
Influencer

I am not very clear about the requirement, but what I understand is based on dropdown selection token will be set with earliest and latest time values.

In your search query in dashboard you can use-

<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...