topic Re: How to show earliest and latest time on dashboard panel title which is same as time select? in Dashboards & Visualizations

How to show earliest and latest time on dashboard panel title which is same as time select?

vrmandadi — Tue, 24 May 2022 20:24:19 GMT

I want to show the time range of that panel that a dashboard has ran from the time select drop -down.For instance , if I select last 90 mins at 1PM from time select the dashboard panel should show the time like earliest_time= 11:30:00 AM to Latest_Time:13:00:00 .

I tried using $field2.earliest$ To Latest_Time: $field2.latest$ but the output is showing as below

Earliest_Time: -90m@m To Latest_Time: now

Thanks in Advance

Re: How to show earliest and latest time on dashboard panel title which is same as time select?

richgalloway — Tue, 24 May 2022 20:41:44 GMT

It's not clear where in the dashboard the tokens are used, but you may be able to use strftime() and relative_time() to convert tokens to better text.

eval start=strftime(relative_time(now(),$field2.earliest|s$), "%c"), eval end=strftime(relative_time(now(),$field2.latest|s$), "%c")

Re: How to show earliest and latest time on dashboard panel title which is same as time select?

vrmandadi — Wed, 25 May 2022 01:02:11 GMT

Sorry for not explaining correctly ..I want the time to be displayed on the panel title of a dashboard.It should show the earliest and latest time of the time select which was selected from dropdown.

Assuming if the time is 1 PM now and I select last 90 mins from timeselect dropdown for the dashboard it should show like below

The panel time range is : earliest_time= 11:30:00 AM to Latest_Time:13:00:00 .

I tried using $field2.earliest$ To Latest_Time: $field2.latest$ but the output is showing as below

Earliest_Time: -90m@m To Latest_Time: now

Re: How to show earliest and latest time on dashboard panel title which is same as time select?

gcusello — Wed, 25 May 2022 06:33:59 GMT

Hi @vrmandadi,

you could use addinfo command to extract the time borders of your search and then display them in a search, somethinh like this:

| makeresults | addinfo | eval info_min_time=strftime(info_min_time,"%Y-%m-%d %H:%M:%S"), info_max_time=strftime(info_max_time,"%Y-%m-%d %H:%M:%S") | table info_min_time info_max_time

and then display one value in a Single Value Panel.

Ciao.

Giuseppe

Re: How to show earliest and latest time on dashboard panel title which is same as time select?

ITWhisperer — Wed, 25 May 2022 06:40:24 GMT

You could use addinfo to get the info_min_time (earliest) and info_max_time (latest) in your search and create tokens in a done handler from the result of the search.

Re: How to show earliest and latest time on dashboard panel title which is same as time select?

vrmandadi — Wed, 25 May 2022 13:46:12 GMT

How to pass the tokens in done handler...I am not sure how it can be done

Re: How to show earliest and latest time on dashboard panel title which is same as time select?

ITWhisperer — Wed, 25 May 2022 14:32:41 GMT

As part of the search for the panel, add a done handler - note that the result field you want must be in the first row of the results - also note that if you use field names with a leading underscore, they won't show up in your table but should be available to the done handler

</query> <done> <eval token="tokenname">$result._fieldname$</eval> </done> </search>

Re: How to show earliest and latest time on dashboard panel title which is same as time select?

gcusello — Wed, 01 Jun 2022 06:19:39 GMT

Hi @vrmandadi,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉