How to change the panel title depending on the time range selected in the time picker?

[SathyaNarayanan]

Hi,

When i choose the @m in time picker, the panel title should show as last month. When i change to @w the panel should change to last week.

Note: I even tried created a dummy panel with the below query

 eval earliest="@y" | eval test=case(earliest="@y","month",earliest="@mon","Month",earliest="@w","Week") | table test

But am unable to pass the field value to the panel title.

Thanks in advance.

[Chamrong]

thanks you. It works

[poete · Accepted solution]

Hello $SathyaNarayanan,

1. Create a hidden panel . You hide the panel with a depends that will never be set. For instance <panel depends="$NotDisplayed$">
2. Link this panel to the timepicker to retrieve the earliest and latest values
3. Create a search looking like the one you posted, but using the timepicker input

4. Use the set token to set a token with the result of your query
   In the end, you should get something like:

   <panel depends="$NotDisplayed$">
     <table>
       <search>
         <query><your query></query>
        <earliest>$timeToken.earliest$</earliest>
        <latest>$timeToken.latest$</latest>
         <done>
           <set token="test">$result.test$</set>
         </done>
       </search>
       <option name="drilldown">none</option>
     </table>
   </panel>
   

You can then use the $test$ in the header of your panel

[SathyaNarayanan]

Thanks a lot $pote.

I even modified the query and tried form present time picker. It worked.

| eval test=case(earliest="-1y@y","month",earliest="-1mon@mon","Month",earliest="-7d@w0","Week")

[SathyaNarayanan]

can u also help me the list of tokens available like "$result.test$". So that i can use for the future.

[niketn]

@SathyaNarayanan, following are some of the resources to pick up on default/custom tokens to be used in Dashboard:

1) Token Usage in Dashboards
2) Token Reference
3) .Conf 2017 presentations on Tokens: Fields, Indexed Tokens and You and Tokens in Splunk Web Framework: Use, Abuse and Incantations
4) Developer Gadgets App for Splunk and
5) Splunk Dashboard Examples App for using and viewing tokens

[SathyaNarayanan]

Thank u $niketnilay ,

You are very kind.

As u mentioned "Developer Gadgets App for Splunk" . I have one more doubt, with the use of this app i have created a toggle button and hided the drill down panel.
Now my team even wants the toggle button to disappear from it. Once they click toggle buttont panel.

[renjith_nair]

Hi @SathyaNarayanan,

Try this example which uses both your use cases

<form>
  <label>TOKENS_TEST</label>
  <fieldset submitButton="false">
    <input type="time" token="timer_tok">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Time FromResult : $my_time$ , Time From Time Picker Earliest : $timer_tok.earliest$ , Time From Time Picker Latest :$timer_tok.latest$</title>
      <table>
        <search>
          <query>| makeresults  | eval earliest="@y" |eval test=case(earliest="@y","month",earliest="@mon","Month",earliest="@w","Week") | table test</query>
          <earliest>-15@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="my_time">$result.test$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>
</form>