Dashboards & Visualizations

How to set up custom logic for conditional tokens in views?

kamal_jagga
Contributor

Hi,

I often face the issue that my data comes late, so I am developing a retro run dashboard. Now my searches have multiple sourcetypes joined together with different earliest and latest values.
Now I want to automate the process of evaluating the earliest and latest values depending on the date. So my tokens would be like:

earliest1=x(will enter manually from dashboard)
latest1=$earliest1$+5
earliest2=$earliest1$+2
latest2=$earliest1$+1

Now, I think this can be done. Found the following details in documentation.

Custom logic examples
You can use an eval expression in event handler elements. Here is an example.

. . . [conditional actions] . . .

You can also compute a token's value based on the result of an eval expression. Here is an example.
[eval expression]

But I am unable to implement it. My code is :

<panel>
  <title>Time Range Picker for Test Search</title>
  <input type="dropdown" token="early" searchWhenChanged="true">
    <label>Earliest Time</label>
    <choice value="-150d@d">150 Days</choice>
    <choice value="-200d@d">200 days</choice>
    <default value="-150d@d">150 Days</default>
 <eval token="late">[$early$-50]</eval>
  </input>   
 </panel>

or, something like :

  <eval x>[$early$-50]</eval>
  <eval token="late">[x-50]</eval>

x is just a variable.

Any advice is appreciated.

0 Karma
1 Solution

kamal_jagga
Contributor

I found a solution to this.
Put a textbox to get value of token

Search would look like.:
index=cricket latest= -7d@d-$token$d@d | head 1| table _time _raw

eg. you want to retro run by 7 days. Put value =7 in token
And search would translate to
index=cricket latest= -7d@d-7d@d | head 1| table _time _raw

i.e will run on data 7 days older data.

View solution in original post

0 Karma

kamal_jagga
Contributor

I found a solution to this.
Put a textbox to get value of token

Search would look like.:
index=cricket latest= -7d@d-$token$d@d | head 1| table _time _raw

eg. you want to retro run by 7 days. Put value =7 in token
And search would translate to
index=cricket latest= -7d@d-7d@d | head 1| table _time _raw

i.e will run on data 7 days older data.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...