Dashboards & Visualizations

Varying search index based on dropdown

keerthana_k
Communicator

Hi
My application uses multiple indexes and reports to summarize data. I need to develop a dashboard where I need to change the index name and report name based on the time range chosen in a drop down box. Is there any way to do this? It should be something like:

if (timerange=="5min")
index=indexName
report=reportName

Tags (1)
0 Karma
1 Solution

jonuwz
Influencer

Yes, if you dont use the default timerange picker.

Sample code :

  <module name="StaticSelect" layoutPanel="panel_row1_col1" group="Dynamic">
<param name="label">Timerange </param>
<param name="settingToCreate">range_selecter</param>
<param name="searchWhenChanged">True</param>
<param name="selected">5min</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="value">index=index1 earliest=-5m@m latest=@m report=report1</param>
    <param name="label">5min</param>
  </list>
  <list>
    <param name="value">index=index2 earliest=-30m@m latest=@m report=report2</param>
    <param name="label">30min</param>
  </list>
  <list>
    <param name="value">index=index1 earliest=-1h@h latest=@h report=report3</param>
    <param name="label">60min</param>
  </list>
  <list>
    <param name="value">index=summary earliest=-1d@d latest=@d report=report4</param>
    <param name="label">1day</param>
  </list>
</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">range_selecter</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="search_prefix">
        <param name="fillOnEmpty">True</param>
        <param name="suffix"> </param>
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
  <module name="HiddenSearch" autoRun="True">
    <param name="search">$search_prefix$ | the rest of your search goes here</param>
    ... charts etc 

View solution in original post

jonuwz
Influencer

Yes, if you dont use the default timerange picker.

Sample code :

  <module name="StaticSelect" layoutPanel="panel_row1_col1" group="Dynamic">
<param name="label">Timerange </param>
<param name="settingToCreate">range_selecter</param>
<param name="searchWhenChanged">True</param>
<param name="selected">5min</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="value">index=index1 earliest=-5m@m latest=@m report=report1</param>
    <param name="label">5min</param>
  </list>
  <list>
    <param name="value">index=index2 earliest=-30m@m latest=@m report=report2</param>
    <param name="label">30min</param>
  </list>
  <list>
    <param name="value">index=index1 earliest=-1h@h latest=@h report=report3</param>
    <param name="label">60min</param>
  </list>
  <list>
    <param name="value">index=summary earliest=-1d@d latest=@d report=report4</param>
    <param name="label">1day</param>
  </list>
</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">range_selecter</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="search_prefix">
        <param name="fillOnEmpty">True</param>
        <param name="suffix"> </param>
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
  <module name="HiddenSearch" autoRun="True">
    <param name="search">$search_prefix$ | the rest of your search goes here</param>
    ... charts etc 
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...