Splunk Search

Display Date on Dashboard panel

chintan_shah
Path Finder

I want to show the previous week date on Title of panel.
Can anyone have some thoughts for it?

Tags (2)
0 Karma
1 Solution

niketn
Legend

You can run a search to calculate previous week date one of the ways would be through makeresults and using relative_time command.
Then you display the same using HTML panel with formatting of your choice.

  <search>
    <query>| makeresults
| eval prevWeekDate=strftime(relative_time(now(),"-7d"),"%Y/%m/%d")
| table prevWeekDate</query>
    <sampleRatio>1</sampleRatio>
    <preview>
      <set token="tok_Prev_Week_Date">$result.prevWeekDate$</set>
    </preview>
  </search>
  <row>
    <panel>
      <html>
        <div>
          <p style="color:blue;text-align:right;font-size:150%">$tok_Prev_Week_Date$
          </p>
        </div>
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

You can run a search to calculate previous week date one of the ways would be through makeresults and using relative_time command.
Then you display the same using HTML panel with formatting of your choice.

  <search>
    <query>| makeresults
| eval prevWeekDate=strftime(relative_time(now(),"-7d"),"%Y/%m/%d")
| table prevWeekDate</query>
    <sampleRatio>1</sampleRatio>
    <preview>
      <set token="tok_Prev_Week_Date">$result.prevWeekDate$</set>
    </preview>
  </search>
  <row>
    <panel>
      <html>
        <div>
          <p style="color:blue;text-align:right;font-size:150%">$tok_Prev_Week_Date$
          </p>
        </div>
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

chintan_shah
Path Finder

Thanks Niketnilay..so we cannot have dynamic title, but need to include html tags.

0 Karma

niketn
Legend

@chintan_shah... You can print this in Title also. I just used html as an example.

<panel>
   <title>Data from - $tok_Prev_Week_Date$ </title>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...