Dashboards & Visualizations

In Splunk dashboard, how can I get todays date as default value in string?

Chandras11
Communicator

Hi All,

I have a dashboard and text input to provide the date as the "YYYY-MM-DD" (For example 2018-06-15) format.
However, for the default value, I have given a static value. I want to get today's date in the default value (with now() function). However, Splunk tells that a query is not possible in the default field. Can anyone please tell me, how can I put today's date in the default value.

" fieldset autoRun="true" submitButton="false">
    input type="text" token="Year_Month_Day_t">
     label>Enter the date as YYYY-MM-DD 
     /label>
      default>2018-06-15 /default>
    /input>
  /fieldset "

P:S. I removed the first < in all tags (for example fieldset, input type, label, default, etc) as Splunk answer was not letting me paste the codes with tags. My concern is for default>2018-06-15 /default> where I want to give today's date from the system.

Thanks a lot for the help.

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try this

<form>
  <search>
    <query>| makeresults|eval today=strftime(_time,"%Y-%m-%d")|fields - _time</query>
    <done>
      <set token="defaut_time">$result.today$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="text" token="field1">
      <label>field1</label>
      <default>$defaut_time$</default>
    </input>
  </fieldset>
</form>

Run a dummy search and set a token and use the token in default field

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

Try this

<form>
  <search>
    <query>| makeresults|eval today=strftime(_time,"%Y-%m-%d")|fields - _time</query>
    <done>
      <set token="defaut_time">$result.today$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="text" token="field1">
      <label>field1</label>
      <default>$defaut_time$</default>
    </input>
  </fieldset>
</form>

Run a dummy search and set a token and use the token in default field

Happy Splunking!

Chandras11
Communicator

Thanks a lot. I already have a query where I am calculating todays date. Let me check it in my code 🙂

0 Karma

Chandras11
Communicator

Working like a charm 🙂 now I can easily put relative time, current week, month etc : ) just a small modification can be : eval today=strftime(now(),"%Y-%m-%d")

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...