All Apps and Add-ons

How to create a dashboard with showing the first and last time of the events

benspader
Explorer

I need to create 2 dashboard panels showing the first and last time of the events being displayed. Has anyone done this? Could you share your simple XML code? I'm trying to do this in Splunk 6.

emiller42
Motivator

I would recommend tackling this using searchPostProcess. Essentially, you have a search that acts as a background search to get your initial data set. Then for each of your dashboard panels, you can use searchPostProcess to append search terms to that master search. This way you can drive multiple visualizations from a single search.

An example which does what you want is here: http://pastebin.com/KfdJjBmS

And this is what it looks like:

screenshot

Keep in mind, that this may not be the fastest dashboard if your dataset is large.

ChrisG
Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...