Splunk 6.5: How to show the timestamp of the last ...

andreafebbo · ‎01-16-2017

I noticed that in the new version of Splunk, i can choose to autorefresh panels.
So i would like to show when my panel was last refreshed.
For doing so I tried to put the last refresh date in a token but it does not work.

My code:

<panel>
      <title>MAIN</title>
      <table>
        <title>BLA</title>
        <search>
          <query> my query | eval lastRrefresh=strftime(now(),"%Y-%m-%d %H:%M:%S") </query>
          <earliest>0</earliest>
          <latest>now</latest>
          <refresh>$r$</refresh>
          <refreshType>delay</refreshType>
          <done>
            <eval token="time">$result.lastRrefresh$</eval>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">true</option>
        <option name="wrap">true</option>
      </table>
    </panel>

For some reason the token does not get any value.

Can someone understand why?

Is there a better, more simple way of showing the last update of a panel?

Thanks

gcusello · ‎01-17-2017

Hi andreafebbo,
Have you seen this answer?
https://answers.splunk.com/answers/455853/how-to-display-last-refreshedupdated-time-in-dashb.html
bye.
Giuseppe

renjith_nair · ‎01-16-2017

Either you can just use the inbuilt property refresh.time.visible as mentioned in the http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/PanelreferenceforSimplifiedXML#Panel_visualiza...

or

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <search>
          <query>|stats count|eval Message="This is my original search"|table Message</query>
          <done>
            <eval token="time">strftime(now(),"%m/%d/%Y %H:%M:%S")</eval>
          </done>
        </search>
      </table>
      <html>
        <h1>$time$</h1>
      </html>
    </panel>
  </row>
</dashboard>

---
What goes around comes around. If it helps, hit it with Karma 🙂

andreafebbo · ‎01-17-2017

I tried to add the option refresh.time.visible but i can't see any changing in the panel.
Maybe i'm adding the option in the wrong place.

    <panel>
      <title>MAIN</title>
      <table>
        <title>Bla</title>
        <search>
          <query>my query</query>
          <earliest>0</earliest>
          <latest>now</latest>
          <refresh>$r$</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">true</option>
        <option name="wrap">true</option>
        <option name="refresh.time.visible">true</option>
      </table>
    </panel>

thank you

gcusello · ‎01-17-2017

In this way the refresh time is shown in a little tab in the bottom of the panel only when your mouse pass on the panel.
Bye.
Giuseppe

andreafebbo · ‎01-17-2017

Is there any way to show it in the title without using the token?

Splunk 6.5: How to show the timestamp of the last refresh of a panel?

Wondering How to Build Resiliency in the Cloud?

Updated Data Management and AWS GDI Inventory in Splunk Observability

Introducing the Splunk Community Dashboard Challenge!