Dashboards & Visualizations

How to add a dynamic custom time input to dashboard?

harishnpandey
Explorer

Hello All,

Currently, I have dashboard which has time input as "Today" which lists the total count of Payments

index=myindex "paymentmodule" | stats count as Payments

I can add another "Time Input -2" with same search which I used above for "Time Input-1"to existing dashboard but I don't know how to make the "Time input -2" dynamic so that I can compare the total counts for any weekday with current day.

For e.g. Total count for current week Wednesday v/s Total count for last week Wednesday

I could not find any option to make Time Range -2 dynamic so that I need not to go and manually change values in time picker

Appreciate your valuable suggestions in advance alt text

Attached dashboard design

0 Karma

niketn
Legend

@harishnpandey, you can do this from the search done event handler it extracted the Job's earliest and latest time and calculates adjusted time as 7 days prior. However, this will work only if single day is selected from the first time picker.

          <done>
            <eval token="adjustedEarliest">relative_time(strptime($job.earliestTime$,"%Y/%m/%d %H:%M:%S"),"-7d")</eval>
            <eval token="adjustedLatest">relative_time(strptime($job.latestTime$,"%Y/%m/%d %H:%M:%S"),"-7d")</eval>
          </done>

Following is run any where example:

<form>
  <label>Dynamic Adjust time Last Week Same day</label>
  <fieldset submitButton="false">
    <input type="time" token="selTime">
      <label>Select Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Current Search</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="WARN"
| timechart count</query>
          <earliest>$selTime.earliest$</earliest>
          <latest>$selTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <eval token="adjustedEarliest">relative_time(strptime($job.earliestTime$,"%Y/%m/%d %H:%M:%S"),"-7d")</eval>
            <eval token="adjustedLatest">relative_time(strptime($job.latestTime$,"%Y/%m/%d %H:%M:%S"),"-7d")</eval>
          </done>
        </search>
        <option name="charting.chart">line</option>
      </chart>
      <chart>
        <title>Adjusted Search</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="WARN"
| timechart count</query>
          <earliest>$adjustedEarliest$</earliest>
          <latest>$adjustedLatest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
      </chart>
    </panel>
  </row>
</form>

If you are on Splunk 6.5, you should also explore the timewrap function for overlaying weekly data. For version prior to 6.5 check out appendcols command to have single query plot current day and last week same day data in a single chart.

Check out the following blog: https://www.splunk.com/blog/2012/02/19/compare-two-time-ranges-in-one-report/

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...