Splunk Enterprise Security

Can you help me create a dashboard with field dependency and action state modifications?

JeffBothel
Explorer

I am attempting to create a dashboard that has a couple input fields with one being dependent on the other.

The independent field will be a drop down to select a value that will then set the time frame for a search to a specific set and disable the use of the other field. There will be a custom selection in the drop down menu that would then set a default value and enable the time input field for utilization. I would like to have the drop-down change the token values for the time picker field so that I have one reference point for time information in the search. I have been working with the drop-down condition items and have yet to create a working solution and I was wondering if someone might have some suggestions. Here is what I have thus far:

<input type="dropdown" token="shift_select" searchWhenChanged="true">
      <label>Shift for Reporting</label>
      <choice value="Shft1">Shift 1</choice>
      <choice value="Shft2">Shift 2</choice>
      <choice value="Shft3">Shift 3</choice>
      <choice value="Custom">Custom</choice>
      <change>
        <condition value="Shft1">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-24h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
        <condition value="Shft2">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-48h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
        <condition value="Shft3">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-72h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
        <condition value="Custom">
          <unset token="time_range"></unset>
          <set token="time_range.earliest">-12h@h</set>
          <set token="time_range.latest">now</set>
          <set token="time_range.enabled">false</set>
        </condition>
      </change>
    </input
0 Karma

Vijeta
Influencer

I am not very clear about the requirement, but what I understand is based on dropdown selection token will be set with earliest and latest time values.

In your search query in dashboard you can use-

<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...