topic Re: Dashboard Title - Display date as DD/MM/YYYY in Splunk Search

Dashboard Title - Display date as DD/MM/YYYY

marziaolla — Wed, 15 Nov 2017 13:33:57 GMT

Hello there,
idk how to display the date in the title of the dashboard format as DD/MM/YYYY, not in epoch format

Here it is the source code:

<form>
  <label>TEST ORA</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <title>$field1.earliest$</title>
      <input type="time" token="field1">
        <label></label>
        <default>
          <earliest>1508450400</earliest>
          <latest>1508623200</latest>
        </default>
      </input>
      <event>
        <search>
          <query>index=test "CURRENT LOGGED USER"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.sortDirection">asc</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

Can someone help me?

TNX 🙂

Re: Dashboard Title - Display date as DD/MM/YYYY

cmerriman — Wed, 15 Nov 2017 14:04:01 GMT

try doing this:

<form>
   <label>TEST ORA</label>
   <fieldset submitButton="false"></fieldset>
   <row>
     <panel>
       <title>$timelabel$</title>
       <input type="time" token="field1">
         <label></label>
         <default>
           <earliest>1508450400</earliest>
           <latest>1508623200</latest>
         </default>
       </input>
<search>
    <query>|makeresults|addinfo</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
          <progress>
            <eval token="timelabel">strftime($result.info_min_time$,"%d/%m/%Y")</eval>
          </progress>
  </search>
       <event>
         <search>
           <query>index=test "CURRENT LOGGED USER"</query>
           <earliest>$field1.earliest$</earliest>
           <latest>$field1.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="count">50</option>
         <option name="list.drilldown">none</option>
         <option name="list.wrap">1</option>
         <option name="maxLines">5</option>
         <option name="raw.drilldown">full</option>
         <option name="rowNumbers">0</option>
         <option name="table.drilldown">all</option>
         <option name="table.sortDirection">asc</option>
         <option name="table.wrap">1</option>
         <option name="type">list</option>
       </event>
     </panel>
   </row>
 </form>

Re: Dashboard Title - Display date as DD/MM/YYYY

niketn — Wed, 15 Nov 2017 14:54:40 GMT

@marziaolla, as @cmerriman has pointed out addinfo command is one of the ways to add Search Job Earliest Time and Latest Time. Other option would be to use default tokens for Job which can be accessed in search event handlers. Refer to one of my answers which illustrates both examples. You can use the toking for String Time to display time in String format of your choice(using strftime()) instead of epoch time.

https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html

Re: Dashboard Title - Display date as DD/MM/YYYY

niketn — Fri, 24 Nov 2017 04:54:33 GMT

@marziaolla, were you able to try out any of the answers provided below?