Dashboards & Visualizations

Use token in the dropdown choice value

karthi25
Path Finder

I have a dropdown with choice values as follows:

        <label>SELECT A TASK NAME</label>

        <choice value="taskName='aaa' status='COMPLETED'| sort -splunkLogId | eval startDateModified= strptime( startDate, &quot;%Y-%m-%d %H:%M:%S&quot;) | eval newDateFromDash = relative_time($dashboardTime.latest$(), &quot;$dashboardTime.earliest$&quot;)
 | where startDateModified > newDateFromDash | eval runDate = strftime(strptime(startDate, &quot;%Y-%m-%d&quot;),&quot;%Y-%m-%d&quot;) |chart sum(rowCount) over runDate">aaa</choice>

        <choice value="taskName='bbb' status='COMPLETED'| sort -splunkLogId |eval startDateModified= strptime( startDate, &quot;%Y-%m-%d %H:%M:%S&quot;) | eval newDateFromDash = relative_time($dashboardTime.latest$(), &quot;$dashboardTime.earliest$&quot;)
 | eval runDate = strftime(strptime(startDate, &quot;%Y-%m-%d&quot;),&quot;%Y-%m-%d&quot;) |chart sum(rowCount) over runDate">bbb</choice>
        .....
        <selectFirstChoice>true</selectFirstChoice>
      </input>

"dashboardTime" is nothing but my time select box token. But the choice value is not getting update with the corresponding values of $dashboardTime.latest$ and $dashboardTime.earliest$ instead it is update with the string "$dashboardTime.latest$ " and "$dashboardTime.earliest$".
Can anyone please suggest me to do it.

0 Karma

bojanisch
Path Finder

Have you set searchWhenChanged = true on the time range picker?

Alternatively why do you parse the time token in your queries? I suggest you to use a changed snippet that transforms the time string constraint directly into an epoch value that can be used in your queries:

<change>
    <eval token="earliest">if(isnum($time.earliest$), $time.earliest$, relative_time(now(), $time.earliest$))</eval>
    <eval token="latest">if(isnum($time.latest$), $time.latest$, relative_time(now(), $time.latest$))</eval>
</change>

You can simply add this to the input definition of your time range picker and use the new tokens $earliest$ and $latest$ for time comparisons. You could also add more tokens and formations, depending on your needs.

Oh and by the way, in your example (your first query) you also need to escape > into &gt; .

0 Karma

493669
Super Champion

also share my time select box query to understand better

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...