topic Re: Concatenate date in label in Splunk Search

Concatenate date in label

vikas_gopal — Mon, 03 Mar 2014 17:12:42 GMT

Hi Everyone,
Is it possible to concatenate current date and time with dashboard label e.g. my dashboard label is "Monthly status report" and I want to show it as "Monthly status report" + "Current date and time".Please suggest me how to do it and if it is not possible with concatenate then how I can achieve this ?

Thanks in advance

Re: Concatenate date in label

aelliott — Mon, 03 Mar 2014 17:20:43 GMT

do you have javascript available to you?

Re: Concatenate date in label

vikas_gopal — Mon, 03 Mar 2014 18:28:31 GMT

I have prepared a javascript which shows me a date in an alert now how I can link this to label ...

Re: Concatenate date in label

yannK — Tue, 04 Mar 2014 00:06:13 GMT

You can concatenate fields values in an eval command using the dot as separator.

examples :
<mywonderfulsearch> | eval newfield=fieldA.fieldB | table newfield

<mywonderfulsearch> | eval newfield=fieldA." and my other information is ".fieldB | table newfield

If you have fields names already in a string with spaces, you will have to use double quotes, so it may mess up the eval.
I recommend to use simple fields names, and rename then at the end at display time.

Re: Concatenate date in label

jhowkins — Tue, 04 Mar 2014 00:46:06 GMT

Assuming you are using advanced XML for your dashboard and you're willing to use SideView Utils' HTML module, the following will work;

<module name="HiddenSearch" autoRun="True">
    <param name="search">index=_internal | stats count | eval ReportLabel = "Monthly status report ".strftime( time(), "%B %e, %Y %k:%M:%S %p") | table ReportLabel</param>
    <module name="HTML">
        <param name="html">
            <![CDATA[
            <p>$results[0].ReportLabel$</p>
            ]]>
        </param>
    </module>  
</module>

You don't necessarily need to concatenate with an eval either. You could change the code above as follows:

eval = strftime( time(), "%B %e, %Y %k:%M:%S %p")

and

<![CDATA[
<p>Monthly status report $results[0].ReportLabel$</p>
]]>

Note: index=_internal can be swapped for whatever index you feel comfortable using

You can format the date/time using Splunk's date and time format variables: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commontimeformatvariables

Re: Concatenate date in label

jhowkins — Tue, 04 Mar 2014 02:22:57 GMT

If you want implement the date as a text label in your dashboard using Javascript, you can also do the following (again, I'm assuming you're using advanced XML and SideView Utils' HTML module);

<module name="HTML">
    <param name="html">
    <![CDATA[

    <script>
        var theDate = new Date();
        $$(function() {
        $$( "#ReportTitle" ).text(theDate);
        });
    </script>

    <h3>Monthly status report <Label id="ReportTitle" ></h3>

    ]]>
    </param>
</module>

I hope this helps!

Re: Concatenate date in label

vikas_gopal — Tue, 04 Mar 2014 09:57:06 GMT

@yannK Thanks for the reply but how I can use eval command with label .I can use it in search bar only....

Re: Concatenate date in label

vikas_gopal — Tue, 04 Mar 2014 10:00:20 GMT

@jhowkins thanks for quick response..I am not using SideView Utils, I am working on simple XML .Is it possible with simple XML..?

Re: Concatenate date in label

vikas_gopal — Tue, 04 Mar 2014 17:05:10 GMT

by using the simple xml code and combination of javascript and read only text box I achieved this...thanks everyone for your valuable inputs..

Re: Concatenate date in label

yannK — Tue, 04 Mar 2014 17:32:00 GMT

understood, the eval works for the results, not the panels names.
the javascript is the way to go.