Dashboards & Visualizations

Span & timepicker

KarunK
Contributor

Hi All,

I would like to give the users an option/control for span in a pull-down based on the value of the time-range picker. This is to prevent the users from using 5min window on 30 day search as the results get truncated in time-charts.

Any Ideas ???

Last 24 hours -> span=5min

Last 7days    -> span=1hr

Last 30days   -> span=1day

etc etc etc

Thanks for your help

Regards

KK

Tags (2)

gyslainlatsa
Motivator

hi KarunK,
try use this example.

<form>
  <label>Time Picker Form Input Element</label>
  <description>Count Source by Time Period using Time Picker</description>

  <fieldset autoRun="true" submitButton="false">       
    <input type="dropdown" token="level" searchWhenChanged="true">
        <label>TimeRange:</label>
        <choice value="-30d@h">Last 30 days</choice>
        <choice value="-7d@h">Last 7 days</choice>
        <choice value="-24h@h">Last 24 hours</choice>
        <choice value="-4h@h">Last 4 hours</choice>
        <choice value="-60m@m">Last 60 minutes</choice>
        <choice value="-15m@m">Last 15 minutes</choice>
        <default>Last 30 days</default>
        <change>
          <condition value="-30d@h">
            <set token="s_level">4 days </set>
          </condition>

          <condition value="-7d@h">
            <set token="s_level">1 day </set>
          </condition>

          <condition value="-24h@h">
            <set token="s_level">6 hours </set>
          </condition>

          <condition value="-4h@h">
            <set token="s_level">1 hour </set>
          </condition>

          <condition value="-60m@m">
            <set token="s_level">10 min </set>
          </condition>

          <condition value="-15m@m">
            <set token="s_level">5 min </set>
          </condition>

        </change>
      </input>
  </fieldset>

  <row>
    <panel>
     <html>
       <h1 style="color:blue;text-align:center"> span=$s_level$ </h1>
    </html>
    </panel>
  </row>

  <row> 
     <panel>
    <chart>
      <title>Chart of Top Sourcetypes between $level$ and $latest$</title>
      <searchString>index=_internal earliest=$level$ latest=now |timechart count by source</searchString>
    </chart>
    </panel>
  </row>
</form>

KarunK
Contributor

No that wont work for us, we are quite a time dependent - internet traffic application. So we prefer a time based reports.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

As a different idea, have you considered giving them control over the number of bins rather than the span?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...