Re: How to pass lookup field values to the time ra...

bollam · ‎02-21-2020

Hello,

I have a lookup file which has fields Month, earliest, latest. I have drop down name "Month" which gives me the list of all the months from the lookup table. When I choose a month from the drop down the respective values of the earliest and the latest should be passed to the searches or time range token in the dashboard.

Month earliest latest
Jan 01/15/2020:03:34:45 01/15/2020:05:34:45
Feb 02/15/2020:03:34:45 02/15/2020:01:34:45
Mar 03/15/2020:03:34:45 03/15/2020:07:34"45
Apr 04/15/2020:03:34:45 04/15/2020:08:34:45

to4kawa · ‎02-21-2020

SAMPLE:

<form>
  <label>lookup to time</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="timepicker" searchWhenChanged="true">
      <label>time piker</label>
      <fieldForLabel>Month</fieldForLabel>
      <fieldForValue>query</fieldForValue>
      <search>
        <query>| makeresults 
| eval _raw="Month earliest latest
Jan 01/15/2020:03:34:45 01/15/2020:05:34:45
Feb 02/15/2020:03:34:45 02/15/2020:01:34:45
Mar 03/15/2020:03:34:45 03/15/2020:07:34:45
Apr 04/15/2020:03:34:45 04/15/2020:08:34:45"
| multikv forceheader=1
| table Month earliest latest
| foreach *est [ eval <<FIELD>> = round(strptime(<<FIELD>>,"%m/%d/%Y:%T"))]
| eval query="(earliest=".earliest." "."latest=".latest.")"</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>token value: $timepicker$</html>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal $timepicker$</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>

recommend:

<input type="dropdown" token="timepicker" searchWhenChanged="true">
   <label>time piker</label>
   <fieldForLabel>Month</fieldForLabel>
   <fieldForValue>query</fieldForValue>
   <search>
     <query>| inputlookup your_csv
| foreach *est [ eval <<FIELD>> = round(strptime(<<FIELD>>,"%m/%d/%Y:%T"))]
| eval query="(earliest=".earliest." "."latest=".latest.")"</query>
     <earliest>0</earliest>
     <latest></latest>
   </search>
 </input>

please put the token $timepicker$ to your main search.

manjunathmeti · ‎02-21-2020

Just thought of sharing this. If date time values are in timeformat %m/%d/%Y:%H:%M:%S, then you can search earliest and latest with them directly. So below query also works.

index=_internal earliest="02/21/2020:05:00:00" latest="02/21/2020:05:05:00"

to4kawa · ‎02-21-2020

SearchTimeModifiers

@manjunathmeti , yes.

| inputlookup your_csv
| eval query="(earliest=".earliest." "."latest=".latest.")"

It's OK.

bollam · ‎02-22-2020

@to4kawa Thank you! It worked..
But I wanted to use the result of the query to change the token using eval. But it's not working.
I need to check a specific value of the earliest from the result. If it matches then I need to use the token and assign some other value to it.
The token value is not getting effected in the panel. Can you help me on this?

    <input type="dropdown" token="timepicker" searchWhenChanged="true">
       <label>time piker</label>
       <fieldForLabel>Month</fieldForLabel>
       <fieldForValue>query</fieldForValue>
       <search>
         <query>| inputlookup sample_file
 | foreach *est [ eval &lt;&lt;FIELD&gt;&gt; = round(strptime(&lt;&lt;FIELD&gt;&gt;,"%m/%d/%Y:%T"))]
 | eval query="(earliest=".earliest." "."latest=".latest.")"
         <earliest>0</earliest>
         <latest></latest>
       </search>
       <change>
        <eval token="abc">if('query.earliest'= 1577817000, (earliest=1577817000 latest=15777903400), (earliest=1577817000 latest=15777903405))</eval>
        </change>
     </input>
     <panel>
       <html>token value: $timepicker$ $abc$</html>
    </panel>

to4kawa · ‎02-22-2020

  <change>
    <eval token="abc">if(mvindex(split($timepicker$,"="),1) = 1577817000,"(earliest=1577817000 latest=1577903400)", "(earliest=1577817000 latest=1577903405)")</eval>
  </change>

query.earliest is nothing.

How to pass lookup field values to the time range?

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

They're back! Join the SplunkTrust and MVP at .conf24

Enterprise Security Content Update (ESCU) | New Releases