Dashboards & Visualizations

How to set up custom logic for conditional tokens in views?

kamal_jagga
Contributor

Hi,

I often face the issue that my data comes late, so I am developing a retro run dashboard. Now my searches have multiple sourcetypes joined together with different earliest and latest values.
Now I want to automate the process of evaluating the earliest and latest values depending on the date. So my tokens would be like:

earliest1=x(will enter manually from dashboard)
latest1=$earliest1$+5
earliest2=$earliest1$+2
latest2=$earliest1$+1

Now, I think this can be done. Found the following details in documentation.

Custom logic examples
You can use an eval expression in event handler elements. Here is an example.

. . . [conditional actions] . . .

You can also compute a token's value based on the result of an eval expression. Here is an example.
[eval expression]

But I am unable to implement it. My code is :

<panel>
  <title>Time Range Picker for Test Search</title>
  <input type="dropdown" token="early" searchWhenChanged="true">
    <label>Earliest Time</label>
    <choice value="-150d@d">150 Days</choice>
    <choice value="-200d@d">200 days</choice>
    <default value="-150d@d">150 Days</default>
 <eval token="late">[$early$-50]</eval>
  </input>   
 </panel>

or, something like :

  <eval x>[$early$-50]</eval>
  <eval token="late">[x-50]</eval>

x is just a variable.

Any advice is appreciated.

0 Karma
1 Solution

kamal_jagga
Contributor

I found a solution to this.
Put a textbox to get value of token

Search would look like.:
index=cricket latest= -7d@d-$token$d@d | head 1| table _time _raw

eg. you want to retro run by 7 days. Put value =7 in token
And search would translate to
index=cricket latest= -7d@d-7d@d | head 1| table _time _raw

i.e will run on data 7 days older data.

View solution in original post

0 Karma

kamal_jagga
Contributor

I found a solution to this.
Put a textbox to get value of token

Search would look like.:
index=cricket latest= -7d@d-$token$d@d | head 1| table _time _raw

eg. you want to retro run by 7 days. Put value =7 in token
And search would translate to
index=cricket latest= -7d@d-7d@d | head 1| table _time _raw

i.e will run on data 7 days older data.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...