All Apps and Add-ons

How to create a dashboard with showing the first and last time of the events

benspader
Explorer

I need to create 2 dashboard panels showing the first and last time of the events being displayed. Has anyone done this? Could you share your simple XML code? I'm trying to do this in Splunk 6.

emiller42
Motivator

I would recommend tackling this using searchPostProcess. Essentially, you have a search that acts as a background search to get your initial data set. Then for each of your dashboard panels, you can use searchPostProcess to append search terms to that master search. This way you can drive multiple visualizations from a single search.

An example which does what you want is here: http://pastebin.com/KfdJjBmS

And this is what it looks like:

screenshot

Keep in mind, that this may not be the fastest dashboard if your dataset is large.

ChrisG
Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...