topic Re: How do I display _time on dashboard panel's title field? in Dashboards & Visualizations

How do I display _time on dashboard panel's title field?

pshangguan — Tue, 09 Oct 2018 17:58:57 GMT

Is there a simple way to display _time on the panel title fields? I am tying to create a dashboard and there are no date/time values in the index query, so I want to reply on _time.

Thanks,
Philip

Re: How do I display _time on dashboard panel's title field?

msivill_splunk — Tue, 09 Oct 2018 18:41:02 GMT

Do you want the current time to appear on the dashboard or do you need a time from a query?

Re: How do I display _time on dashboard panel's title field?

Vijeta — Tue, 09 Oct 2018 18:42:01 GMT

The _time field will be there in your index. You want to display time field for all events or a single event? You can search on index and pass the _time field as token and pass the token to your panel title

Re: How do I display _time on dashboard panel's title field?

pshangguan — Tue, 09 Oct 2018 19:22:39 GMT

I want to catch the event time which I believe is in _time.

Re: How do I display _time on dashboard panel's title field?

pshangguan — Tue, 09 Oct 2018 19:24:06 GMT

A single event. I am trying to find the latest event and display its status(using single field panel), and I want to use the event time _time and display it in the title field.

Re: How do I display _time on dashboard panel's title field?

Vijeta — Tue, 09 Oct 2018 19:49:49 GMT

You can have your query assuming you have a status field in event

<panel>
<title>$title$</title>
<search>
<query>
index=<yourindexname> | stats latest(status) as status, latest(_time) as time| fields status time
</query>
<done>
<set token="title">time<set>
</done>

Re: How do I display _time on dashboard panel's title field?

marycordova — Tue, 09 Oct 2018 20:35:38 GMT

latest(_time) as time

Re: How do I display _time on dashboard panel's title field?

Vijeta — Tue, 09 Oct 2018 20:38:10 GMT

Sorry was a typo, updated it. Thanks for pointing 🙂

Re: How do I display _time on dashboard panel's title field?

marycordova — Tue, 09 Oct 2018 20:55:05 GMT

you should convert the comment to an answer 🙂

Re: How do I display _time on dashboard panel's title field?

pshangguan — Tue, 09 Oct 2018 22:09:52 GMT

I have the following code:

<panel>
  <single>
    <title>$mytitle$</title>
    <search>
      <query>index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-DEV2/" | stats latest(job_result) as status, latest(_time) as time | fields status time</query>
      <done>
        <set token="mytitle">time</set>
      </done>
      <earliest>-4h@m</earliest>
      <latest>now</latest>
    </search>
  </single>
</panel>

I am getting "time" displayed in the panel instead of the actual time. I run the query in splunk search and was able to see the status and the time.

Re: How do I display _time on dashboard panel's title field?

Vijeta — Wed, 10 Oct 2018 01:52:14 GMT

Please use below to set the time token. Also you may want to convert your time YYYY/mm/dd h:m:s format before passing it as token

 <set token="mytitle">$result.time$</set>

Re: How do I display _time on dashboard panel's title field?

dstile — Wed, 10 Oct 2018 02:51:14 GMT

This may get a little far from your original question, but including it in case it's helpful:

If you are providing a way for your user to select their search times anyway, then you can just use that token elsewhere in your title. Personally I would rather display the end of the search period rather than the last event found. If so, then use the earliest and latest modifiers, for example: $timer_tok.latest$

Alternately if you want to know when the Search Job stopped, try $job.latestTime$

This page has some great token info including both of those examples:
https://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/tokens

Re: How do I display _time on dashboard panel's title field?

pshangguan — Wed, 10 Oct 2018 20:14:18 GMT

That worked. Thanks!!!

Re: How do I display _time on dashboard panel's title field?

Vijeta — Wed, 10 Oct 2018 20:34:15 GMT

Please accept the answer , if it resolved your issue 🙂

Re: How do I display _time on dashboard panel's title field?

Jouman — Thu, 31 Aug 2023 05:17:46 GMT

Hi Pshangguan,

After I modity time into $result.time$, the actual time still doesn't appear on the title.

Do you succesfully make the actual time appear in your panel title ?

Thanks.