Is there anyway to determine the amount of time selected from a time picker? For example, if a user selected 1 day or less, I would like to show one set of reports, but if a user selects more than 1 day, I would like to show a different set.
<input type="time" token="maintime" searchWhenChanged="true">
<label>Select Date/Time</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<p>$maintime.earliest$ to $maintime.latest$ </p>
I think you're looking for this:
<form>
<fieldset submitButton="false">
<input type="time" token="maintime" searchWhenChanged="true">
<label>Select Date/Time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
<change>
<condition match="relative_time(now(), latest) - relative_time(now(), earliest) > 86400">
<set token="more_than_day_tok">1</set>
<unset token="less_than_day_tok"></unset>
</condition>
<condition match="relative_time(now(), latest) - relative_time(now(), earliest) <= 86400">
<unset token="more_than_day_tok"></unset>
<set token="less_than_day_tok">1</set>
</condition>
</change>
</input>
</fieldset>
<row depends="$less_than_day_tok$">
<panel>
<table>
<title>This is a panel for less than a day</title>
<search>
...
</table>
</panel>
</row>
<row depends="$more_than_day_tok$">
<panel>
<table>
<title>This is a panel for more than a day</title>
<search>
...
</table>
</panel>
</row>
</form>
This will set a token depending on the duration of the time selected, coping with both relative (-1d@h) and absolute (epoch timestamp) values. The magic is in the <change> and <condition> statements.
By the way, when you want to use this as XML for your dashboard, don't forget to replace
< and >
with
< and >
in the <condition> lines or your UI will complain about invalid XML.
I think you're looking for this:
<form>
<fieldset submitButton="false">
<input type="time" token="maintime" searchWhenChanged="true">
<label>Select Date/Time</label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
<change>
<condition match="relative_time(now(), latest) - relative_time(now(), earliest) > 86400">
<set token="more_than_day_tok">1</set>
<unset token="less_than_day_tok"></unset>
</condition>
<condition match="relative_time(now(), latest) - relative_time(now(), earliest) <= 86400">
<unset token="more_than_day_tok"></unset>
<set token="less_than_day_tok">1</set>
</condition>
</change>
</input>
</fieldset>
<row depends="$less_than_day_tok$">
<panel>
<table>
<title>This is a panel for less than a day</title>
<search>
...
</table>
</panel>
</row>
<row depends="$more_than_day_tok$">
<panel>
<table>
<title>This is a panel for more than a day</title>
<search>
...
</table>
</panel>
</row>
</form>
This will set a token depending on the duration of the time selected, coping with both relative (-1d@h) and absolute (epoch timestamp) values. The magic is in the <change> and <condition> statements.
By the way, when you want to use this as XML for your dashboard, don't forget to replace
< and >
with
< and >
in the <condition> lines or your UI will complain about invalid XML.
If you have 2 searches like search_A
and search_B
then do this:
| noop | stats count AS SingleUselessEventToGenerateSingleMapSearch | addinfo | eval spanSeconds = info_max_time - info_min_time | eval searchString = if((spanSeconds<=(60*60*24)), "search_A", "search_B") | map search="search $searchString$"