I have tried to pass a token into a panel title from a search that creates month names for last month and the month before that. I have tried using CDATA and just $xxxx$ in the title. Hellllp!
I got it to work but it uses input time. The time will always be -1mon and -2mon. How can I hide that so its not seen?
test
<panel>
<html> <p><center> <b><font size="5">$last_month$ Count</font></b></center></p></html>
</panel>
<panel>
<html> <p><center> <b><font size="5">$twoMonths$ Count</font></b></center></p> </html>
</panel>
No need for a search to do that:
<form>
<init>
<eval token="last_month">strftime(relative_time(time(), "-1mon"), "%b")</eval>
</init>
<row>
<panel>
<title>$last_month$</title>
</panel>
</row>
</form>
I can post my code but, the code above doesnt work for me either. Odd??
@c0rrinn3,
Which version of Splunk Are you on?
section in Simple XML Dashboard is available from Splunk Enterprise 6.5 onward.
Are you adding token to title from UI Panel Edit or Simple XML code?
If you add from UI Panel Edit then $
sign for token will escape as $$
and it will be treated as string rather than token.
Kindly share you current code which is not working and your Splunk Enteprise version as well.
I am on Enterprise 6.4. I have tried a different code also and have combined both in the following example. The example I found with the giraffe works but I cant get it to generate previous month.
TimeTestTakeThree
<input type="text" token="newname">
<label>labelrino</label>
<default>giraffe</default>
<change>
<eval token="Ucase">upper('value')</eval>
<eval token="leno">len('value')</eval>
</change>
<html>
<p>Raw Entry: <b>$newname$</b></p>
<p>Upper(raw):<b>$Ucase$</b></p>
<p>Length(raw): <b>$leno$</b></p>
</html>
<eval token="last_month">strftime(relative_time(time(), "-1mon"), "%b")</eval>
<panel>
<title>$last_month$</title>
</panel>
That example I posted isnt the one I meant to post. the bottom panel should be the one from above.
Check out this app:
https://splunkbase.splunk.com/app/1603/
Post your XML. This is totally doable and you are probably missing something very basic.