adding a dynamic time to a panel title

[monkeymole]

I am trying to display the time frame that some of my graphs are displaying, because they are not time charts this information is not dynamic for viewers and therefore less informative.
I would like the panel of a graph showing data from -mon$mon to show the dates that the data starts from and ends at.
I thought that something like $earliestTime$ would use the value that the query is using, but this does not seem to be the case, does anyone have any other ideas?

[jtrujillo]

is this still something that hasn't been addressed in Simple XML?

I have reports that look over "previous month" and I want the title to say "June report" dynamically... based on the month its running for...

[sideview]

You'd have to use the Advanced XML for this in any event. With just the core Splunk modules you are very limited and I'm pretty sure only the "SimpleResultsHeader" module can do this. I think the key you have to use is "$time$", which key is a convention only that one module uses.

With Sideview Utils on the other hand, you have a lot more options. Pretty much every param in every Sideview module does $foo$ substitution when you need it, and you have several keys to represent aspects of the timerange. And you can use the Sideview HTML module to display your key in whatever HTML tags you need and assuming it's downstream from the relevant search the timerange display will update as the search is modified.

$search.timeRange.label$ will give you the human-readable timerange of the arguments used. So (-30d,now) will come out as "last 30 days", and midnight June 1st to midnight July 1st will come out as "during June 2013".

$results.timeRange.label$ is similar, but instead of describing the timerange arguments sent, this will give you the human-readable a absolute timerange over which the underlying job was run. So no matter whether this is a relative timerange search, or a realtime search, the timerange displayed will always be an absolute timerange, eg: "from 8:56PM to 9:00PM June 28 2013".

And there's actually a whole page in Sideview Utils dedicated to an overview of all the $foo$ tokens, as well as a huge amount of information in all the individual docs pages and working examples (60+ pages).

You can download it from the Sideview site
http://sideviewapps.com/apps/sideview-utils and it is free for internal use.

[chris]

Have you had a look at the sideview-utils app http://sideviewapps.com/apps/sideview-utils/ it will provide the $foo$ keys you can use and make developing views/dashboards a lot easier. There are a lot of demos of the features the app adds to the standard Splunk UI possibilities.