Dashboards & Visualizations

Varying search index based on dropdown

keerthana_k
Communicator

Hi
My application uses multiple indexes and reports to summarize data. I need to develop a dashboard where I need to change the index name and report name based on the time range chosen in a drop down box. Is there any way to do this? It should be something like:

if (timerange=="5min")
index=indexName
report=reportName

Tags (1)
0 Karma
1 Solution

jonuwz
Influencer

Yes, if you dont use the default timerange picker.

Sample code :

  <module name="StaticSelect" layoutPanel="panel_row1_col1" group="Dynamic">
<param name="label">Timerange </param>
<param name="settingToCreate">range_selecter</param>
<param name="searchWhenChanged">True</param>
<param name="selected">5min</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="value">index=index1 earliest=-5m@m latest=@m report=report1</param>
    <param name="label">5min</param>
  </list>
  <list>
    <param name="value">index=index2 earliest=-30m@m latest=@m report=report2</param>
    <param name="label">30min</param>
  </list>
  <list>
    <param name="value">index=index1 earliest=-1h@h latest=@h report=report3</param>
    <param name="label">60min</param>
  </list>
  <list>
    <param name="value">index=summary earliest=-1d@d latest=@d report=report4</param>
    <param name="label">1day</param>
  </list>
</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">range_selecter</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="search_prefix">
        <param name="fillOnEmpty">True</param>
        <param name="suffix"> </param>
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
  <module name="HiddenSearch" autoRun="True">
    <param name="search">$search_prefix$ | the rest of your search goes here</param>
    ... charts etc 

View solution in original post

jonuwz
Influencer

Yes, if you dont use the default timerange picker.

Sample code :

  <module name="StaticSelect" layoutPanel="panel_row1_col1" group="Dynamic">
<param name="label">Timerange </param>
<param name="settingToCreate">range_selecter</param>
<param name="searchWhenChanged">True</param>
<param name="selected">5min</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="value">index=index1 earliest=-5m@m latest=@m report=report1</param>
    <param name="label">5min</param>
  </list>
  <list>
    <param name="value">index=index2 earliest=-30m@m latest=@m report=report2</param>
    <param name="label">30min</param>
  </list>
  <list>
    <param name="value">index=index1 earliest=-1h@h latest=@h report=report3</param>
    <param name="label">60min</param>
  </list>
  <list>
    <param name="value">index=summary earliest=-1d@d latest=@d report=report4</param>
    <param name="label">1day</param>
  </list>
</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">range_selecter</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="search_prefix">
        <param name="fillOnEmpty">True</param>
        <param name="suffix"> </param>
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
  <module name="HiddenSearch" autoRun="True">
    <param name="search">$search_prefix$ | the rest of your search goes here</param>
    ... charts etc 
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...