Re: how to add couple of data value in a dashboard

vanakkam777 · ‎10-24-2019

Hi
I have a dashboard created with a PIE chart. I want to add on the dashboard start and end time for which this pie chart is created. Let us say this chart is created for doing a 24 hrs data analysis and creating the PIE chart.
Start time : now-24h End Time: Now displayed above the Pie chart.

if that is not possible at least I need that start and end time printed on somewhere in the chart when I send it as email PDF to clients. so they know this report is for the data period starting and ending used

woodcock · ‎10-25-2019

You can use | addinfo to create info_min_time and info_max_time fields and create tokens and then use these in the title of the dashboard panel with My panel name from $info_min_time$ to $info_max_time$.

gcusello · ‎10-25-2019

Hi
as you can see at https://docs.splunk.com/Documentation/Splunk/7.3.2/Viz/tokens , you can use the search tokens $job.earliestTime$ and $job.latestTime$ to add start and end time to one of the panel's title or to an html box, in the following example I added to both of them.
Something like this:

<form>
  <label>test</label>
     <search>
     <query>| makeresults
     </query>
          <earliest>$Time.earliest$</earliest>
          <latest>$Time.latest$</latest>
     <done>
       <eval token="earliestTime">$job.earliestTime$</eval>
       <eval token="latestTime">$job.latestTime$</eval>
     </done>
   </search>
  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>-1d@d</earliest>
        <latest>@d</latest>
      </default>
    </input>
  </fieldset>
  <row>
       <html>
         Date &amp; Time Range Between: $earliestTime$ and $latestTime$ 
       </html>
  </row>
  <row>
    <panel>
      <title>$earliestTime$ - $latestTime$</title>
      <event>
        <search>
          <query>index=...</query>
          <earliest>$Time.earliest$</earliest>
          <latest>$Time.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.sortDirection">asc</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

Ciao.
Giuseppe

how to add couple of data value in a dashboard

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

Troubleshooting the OpenTelemetry Collector

Adoption of Infrastructure Monitoring at Splunk