- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Use token in the dropdown choice value
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use token in the dropdown choice value
I have a dropdown with choice values as follows:
<label>SELECT A TASK NAME</label>
<choice value="taskName='aaa' status='COMPLETED'| sort -splunkLogId | eval startDateModified= strptime( startDate, "%Y-%m-%d %H:%M:%S") | eval newDateFromDash = relative_time($dashboardTime.latest$(), "$dashboardTime.earliest$")
| where startDateModified > newDateFromDash | eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d") |chart sum(rowCount) over runDate">aaa</choice>
<choice value="taskName='bbb' status='COMPLETED'| sort -splunkLogId |eval startDateModified= strptime( startDate, "%Y-%m-%d %H:%M:%S") | eval newDateFromDash = relative_time($dashboardTime.latest$(), "$dashboardTime.earliest$")
| eval runDate = strftime(strptime(startDate, "%Y-%m-%d"),"%Y-%m-%d") |chart sum(rowCount) over runDate">bbb</choice>
.....
<selectFirstChoice>true</selectFirstChoice>
</input>
"dashboardTime" is nothing but my time select box token. But the choice value is not getting update with the corresponding values of $dashboardTime.latest$ and $dashboardTime.earliest$ instead it is update with the string "$dashboardTime.latest$ " and "$dashboardTime.earliest$".
Can anyone please suggest me to do it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you set searchWhenChanged = true on the time range picker?
Alternatively why do you parse the time token in your queries? I suggest you to use a changed snippet that transforms the time string constraint directly into an epoch value that can be used in your queries:
<change>
<eval token="earliest">if(isnum($time.earliest$), $time.earliest$, relative_time(now(), $time.earliest$))</eval>
<eval token="latest">if(isnum($time.latest$), $time.latest$, relative_time(now(), $time.latest$))</eval>
</change>
You can simply add this to the input definition of your time range picker and use the new tokens $earliest$ and $latest$ for time comparisons. You could also add more tokens and formations, depending on your needs.
Oh and by the way, in your example (your first query) you also need to escape > into > .
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
also share my time select box query to understand better
Introducing the 2024 Splunk MVPs!
Splunk Custom Visualizations App End of Life
Introducing Splunk Enterprise 9.2
