|
Can I create a dashboard that the searches depend on time range selected? For my case, I want to query 24 hours data from original index and timechart span=5min When user selected time range larger than 24 hours, then it will search data from summary index and with timechart span=1h. Does TimeRangePicker allow such customization? Or I need to use Sideview? Philip |
|
There's a "hack" that allows you to choose a different summary index as the query-source depending on the selected timerange: So this will expand to Unfortunately this can't be used to alter the span parameter for the timerange command. Thank you so much! I think it can really solve my problem. I'd like to learn more.
<your search=""> [ stats count | addinfo | eval range=info_max_time - info_min_time | eval search=if(range<=86400, "index=summary1", "index=summary2") ] | timechart count I think span is not a big concern
(14 May '12, 23:26)
philip.wong
|
|
If you don't explicitly specify a span for Indeed I have tried. Seems Splunk won't choose span=5min. (I guess 15min is the default minimal) And I still have problem to make my index to be dynamic... Thanks!
(11 May '12, 02:42)
philip.wong
Ah, I missed the part of using the summary index instead of the default, sorry. To my knowledge this is not possible to do (or at least not easily done).
(11 May '12, 02:51)
Ayn
Yes... badly it becomes my next problem now... I tried to fix the span=5m. But it's fine to retrieve per 1h data from summary index for 7 days. But if I change the range to 30 days, it will show nothing in timechart!
(15 May '12, 01:21)
philip.wong
|
