I created a dashboard using Simple XML under Splunk 6. I created a search "* | stats count | addinfo | eval date=strftime(info_min_time,"%B %d %Y") | fields date" and currently use a single value box. I would prefer to put that date at the top of the dashboard in the label. I need to use Simple XML so I can email the report daily to the end user.
You won't be able to change the <label></label>
value that populates the form/dashboard title using Simple XML. However, you can change the value that populates the title of a panel if you convert to using a form search. Here's a working example:
<form>
<label>Splunk Answers (125114) Example</label>
<fieldset autoRun="false" submitButton="false">
<input type="text" token="name">
<label>Command:</label>
<default>*</default>
<suffix>*</suffix>
</input>
<input type="dropdown" token="begin" searchWhenChanged="true">
<label>Choose Start Date:</label>
<populatingSearch fieldForLabel="day" fieldForValue="day">
sourcetype="syslog" | bucket span=1d _time AS day | dedup day | sort -day | convert timeformat="%B %d %Y" ctime(day)
</populatingSearch>
<default></default>
</input>
</fieldset>
<row>
<table>
<title>syslog "COMMANDS" since $begin$</title>
<searchString>sourcetype="syslog" [|gentimes start=-1 | eval earliest=strptime("$begin$","%B %d %Y") | fields earliest] | search COMMAND="$name$"</searchString>
<option name="count">5</option>
<option name="wrap">true</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
</table>
</row>
</form>
Basically, I created a dropdown that replaces the time picker and allows you to choose the start date for your form. You can use the time picker and it's $earliest$
token instead but the value placed into $earliest$
will be something like -30d@d
which isn't helpful as the date to be displayed in the panel title.
If you need to specify a start time different from some day at midnight, you'll just have to be sure you also modify the strptime()
parameters. Also, it would be simple to add a second dropdown to specify the ending date/time. Alertantively, you could add a time picker and use the $earliest$
and $latest$
tokens created by the time picker to set bounds on the date dropdown.
But the bottom line is that you can't change the title of the form/dashboard using Simple XML.