Splunk Search

How to get token of span used in timechart?

mxh7777
Path Finder

Hello,

I have a search (timechart) with a dynamic span (minspan=1h)

Is there a way (token ?) to get the span used to use it in drilldown ?

Thanks

 

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @mxh7777,

you can add an input to set a token for the span,

something like this:

    <input type="dropdown" token="span">
      <label>Span</label>
      <choice value="1d">1 Day</choice>
      <choice value="1w">1 Week</choice>
      <choice value="1mon">1 Month</choice>
      <default>1d</default>
    </input>

and adding to the search

| timechart span=$span$ count

Ciao.

Giuseppe

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats range(_time) as _span window=2
| eventstats max(_span) as _span
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mxh7777,

you can add an input to set a token for the span,

something like this:

    <input type="dropdown" token="span">
      <label>Span</label>
      <choice value="1d">1 Day</choice>
      <choice value="1w">1 Week</choice>
      <choice value="1mon">1 Month</choice>
      <default>1d</default>
    </input>

and adding to the search

| timechart span=$span$ count

Ciao.

Giuseppe

mxh7777
Path Finder

Thanks @gcusello 

It works perfectly

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mxh7777,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated ;-

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...