Dashboards & Visualizations

Displaying Dynamic date in Simple XML dashboard

coleman07
Path Finder

I created a dashboard using Simple XML under Splunk 6. I created a search "* | stats count | addinfo | eval date=strftime(info_min_time,"%B %d %Y") | fields date" and currently use a single value box. I would prefer to put that date at the top of the dashboard in the label. I need to use Simple XML so I can email the report daily to the end user.

gauldridge
Path Finder

You won't be able to change the <label></label> value that populates the form/dashboard title using Simple XML. However, you can change the value that populates the title of a panel if you convert to using a form search. Here's a working example:

<form>
  <label>Splunk Answers (125114) Example</label>
  <fieldset autoRun="false" submitButton="false">
    <input type="text" token="name">
      <label>Command:</label>
      <default>*</default>
      <suffix>*</suffix>
    </input>

    <input type="dropdown" token="begin" searchWhenChanged="true">
      <label>Choose Start Date:</label>
      <populatingSearch fieldForLabel="day" fieldForValue="day">
        sourcetype="syslog" | bucket span=1d _time AS day | dedup day | sort -day | convert timeformat="%B %d %Y" ctime(day)
      </populatingSearch>
      <default></default>
    </input>

  </fieldset>
  <row>
    <table>
      <title>syslog "COMMANDS" since $begin$</title>
      <searchString>sourcetype="syslog" [|gentimes start=-1 | eval earliest=strptime("$begin$","%B %d %Y") | fields earliest] | search COMMAND="$name$"</searchString>
      <option name="count">5</option>
      <option name="wrap">true</option>
      <option name="dataOverlayMode">none</option>
      <option name="drilldown">row</option>
    </table>
  </row>
</form>

Basically, I created a dropdown that replaces the time picker and allows you to choose the start date for your form. You can use the time picker and it's $earliest$ token instead but the value placed into $earliest$ will be something like -30d@d which isn't helpful as the date to be displayed in the panel title.

If you need to specify a start time different from some day at midnight, you'll just have to be sure you also modify the strptime() parameters. Also, it would be simple to add a second dropdown to specify the ending date/time. Alertantively, you could add a time picker and use the $earliest$ and $latest$ tokens created by the time picker to set bounds on the date dropdown.

But the bottom line is that you can't change the title of the form/dashboard using Simple XML.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...