Hi All,
I would like to give the users an option/control for span in a pull-down based on the value of the time-range picker. This is to prevent the users from using 5min window on 30 day search as the results get truncated in time-charts.
Any Ideas ???
Last 24 hours -> span=5min
Last 7days -> span=1hr
Last 30days -> span=1day
etc etc etc
Thanks for your help
Regards
KK
hi KarunK,
try use this example.
<form>
<label>Time Picker Form Input Element</label>
<description>Count Source by Time Period using Time Picker</description>
<fieldset autoRun="true" submitButton="false">
<input type="dropdown" token="level" searchWhenChanged="true">
<label>TimeRange:</label>
<choice value="-30d@h">Last 30 days</choice>
<choice value="-7d@h">Last 7 days</choice>
<choice value="-24h@h">Last 24 hours</choice>
<choice value="-4h@h">Last 4 hours</choice>
<choice value="-60m@m">Last 60 minutes</choice>
<choice value="-15m@m">Last 15 minutes</choice>
<default>Last 30 days</default>
<change>
<condition value="-30d@h">
<set token="s_level">4 days </set>
</condition>
<condition value="-7d@h">
<set token="s_level">1 day </set>
</condition>
<condition value="-24h@h">
<set token="s_level">6 hours </set>
</condition>
<condition value="-4h@h">
<set token="s_level">1 hour </set>
</condition>
<condition value="-60m@m">
<set token="s_level">10 min </set>
</condition>
<condition value="-15m@m">
<set token="s_level">5 min </set>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<html>
<h1 style="color:blue;text-align:center"> span=$s_level$ </h1>
</html>
</panel>
</row>
<row>
<panel>
<chart>
<title>Chart of Top Sourcetypes between $level$ and $latest$</title>
<searchString>index=_internal earliest=$level$ latest=now |timechart count by source</searchString>
</chart>
</panel>
</row>
</form>
No that wont work for us, we are quite a time dependent - internet traffic application. So we prefer a time based reports.
As a different idea, have you considered giving them control over the number of bins rather than the span?