Dashboards & Visualizations

Span & timepicker

KarunK
Contributor

Hi All,

I would like to give the users an option/control for span in a pull-down based on the value of the time-range picker. This is to prevent the users from using 5min window on 30 day search as the results get truncated in time-charts.

Any Ideas ???

Last 24 hours -> span=5min

Last 7days    -> span=1hr

Last 30days   -> span=1day

etc etc etc

Thanks for your help

Regards

KK

Tags (2)

gyslainlatsa
Motivator

hi KarunK,
try use this example.

<form>
  <label>Time Picker Form Input Element</label>
  <description>Count Source by Time Period using Time Picker</description>

  <fieldset autoRun="true" submitButton="false">       
    <input type="dropdown" token="level" searchWhenChanged="true">
        <label>TimeRange:</label>
        <choice value="-30d@h">Last 30 days</choice>
        <choice value="-7d@h">Last 7 days</choice>
        <choice value="-24h@h">Last 24 hours</choice>
        <choice value="-4h@h">Last 4 hours</choice>
        <choice value="-60m@m">Last 60 minutes</choice>
        <choice value="-15m@m">Last 15 minutes</choice>
        <default>Last 30 days</default>
        <change>
          <condition value="-30d@h">
            <set token="s_level">4 days </set>
          </condition>

          <condition value="-7d@h">
            <set token="s_level">1 day </set>
          </condition>

          <condition value="-24h@h">
            <set token="s_level">6 hours </set>
          </condition>

          <condition value="-4h@h">
            <set token="s_level">1 hour </set>
          </condition>

          <condition value="-60m@m">
            <set token="s_level">10 min </set>
          </condition>

          <condition value="-15m@m">
            <set token="s_level">5 min </set>
          </condition>

        </change>
      </input>
  </fieldset>

  <row>
    <panel>
     <html>
       <h1 style="color:blue;text-align:center"> span=$s_level$ </h1>
    </html>
    </panel>
  </row>

  <row> 
     <panel>
    <chart>
      <title>Chart of Top Sourcetypes between $level$ and $latest$</title>
      <searchString>index=_internal earliest=$level$ latest=now |timechart count by source</searchString>
    </chart>
    </panel>
  </row>
</form>

KarunK
Contributor

No that wont work for us, we are quite a time dependent - internet traffic application. So we prefer a time based reports.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

As a different idea, have you considered giving them control over the number of bins rather than the span?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...