topic Re: I want to replace hard coded text "Today" by current system date in splunk report in Splunk Search

I want to replace hard coded text "Today" by current system date in splunk report

avikc100 — Thu, 24 Apr 2025 20:09:38 GMT

I want to replace hard coded text "Today" by current system date in splunk report. Please help if it is possible.
Please see the attachment.

Re: I want to replace hard coded text "Today" by current system date in splunk report

livehybrid — Thu, 24 Apr 2025 20:25:58 GMT

Hi @avikc100

You can create a search that calculates the relevant dates which set tokens and then use the tokens:

<search id="days"> <query>| makeresults | eval dayMinus0=strftime(now(), "%d/%m/%Y") | eval dayMinus1=strftime(now()-86400, "%d/%m/%Y") | eval dayMinus2=strftime(now()-(86400*2), "%d/%m/%Y") | eval dayMinus3=strftime(now()-(86400*3), "%d/%m/%Y") | eval dayMinus4=strftime(now()-(86400*4), "%d/%m/%Y") | eval dayMinus5=strftime(now()-(86400*5), "%d/%m/%Y")</query> <done> <set token="dayMinus0">$result.dayMinus0$</set> <set token="dayMinus1">$result.dayMinus1$</set> <set token="dayMinus2">$result.dayMinus2$</set> <set token="dayMinus3">$result.dayMinus3$</set> <set token="dayMinus4">$result.dayMinus4$</set> <set token="dayMinus5">$result.dayMinus5$</set> </done> </search>

Then use $dayMinusN$ for each Title - where N is the number of days, like this:

Below is the full XML example of that dashboard above for you to play with if it helps:

<dashboard version="1.1" theme="light"> <label>SplunkAnswers1</label> <search id="days"> <query>| makeresults | eval dayMinus0=strftime(now(), "%d/%m/%Y") | eval dayMinus1=strftime(now()-86400, "%d/%m/%Y") | eval dayMinus2=strftime(now()-(86400*2), "%d/%m/%Y") | eval dayMinus3=strftime(now()-(86400*3), "%d/%m/%Y") | eval dayMinus4=strftime(now()-(86400*4), "%d/%m/%Y") | eval dayMinus5=strftime(now()-(86400*5), "%d/%m/%Y")</query> <done> <set token="dayMinus0">$result.dayMinus0$</set> <set token="dayMinus1">$result.dayMinus1$</set> <set token="dayMinus2">$result.dayMinus2$</set> <set token="dayMinus3">$result.dayMinus3$</set> <set token="dayMinus4">$result.dayMinus4$</set> <set token="dayMinus5">$result.dayMinus5$</set> </done> </search> <search id="baseTest"> <query>|tstats count where index=_internal by _time, host span=1d | eval daysAgo=floor((now()-_time)/86400)</query> <earliest>-7d@d</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <row> <panel> <table> <title>$dayMinus0$</title> <search base="baseTest"> <query>| where daysAgo=0 | table host count</query> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <table> <title>$dayMinus1$</title> <search base="baseTest"> <query>| where daysAgo=1 | table host count</query> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <table> <title>$dayMinus2$</title> <search base="baseTest"> <query>| where daysAgo=2 | table host count</query> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <table> <title>$dayMinus3$</title> <search base="baseTest"> <query>| where daysAgo=3 | table host count</query> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <table> <title>$dayMinus4$</title> <search base="baseTest"> <query>| where daysAgo=4 | table host count</query> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <table> <title>$dayMinus5$</title> <search base="baseTest"> <query>| where daysAgo=5 | table host count</query> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard>

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: I want to replace hard coded text "Today" by current system date in splunk report

yuanliu — Fri, 25 Apr 2025 03:44:18 GMT

This is confusing: how do you get those "hard coded" text in the first place? In Splunk, the opposite is harder, rendering system date into English word strings.

But if you got those strings in some dataset, you sure can "translate" them back. Suppose your hard coded input is called hardcoded, this search will turn the string into systemdate:

| eval decrement = case( hardcoded == "Today", 0, hardcoded == "Yesterday", 1, true(), replace(hardcoded, "Last (\d+).+", "\1") ) | eval systemdate = strftime(relative_time(now(), "-" . decrement . "day"), "%F")

decrement	hardcoded	systemdate
0	Today	2025-04-24
1	Yesterday	2025-04-23
2	Last 2nd Day	2025-04-22
3	Last 3rd Day	2025-04-21
4	Last 4th Day	2025-04-20
5	Last 5th Day	2025-04-19

Here is a full emulation for you to play with and compare with real data.

| makeresults format=csv data="hardcoded Today Yesterday Last 2nd Day Last 3rd Day Last 4th Day Last 5th Day" | eval decrement = case( hardcoded == "Today", 0, hardcoded == "Yesterday", 1, true(), replace(hardcoded, "Last (\d+).+", "\1") ) | eval systemdate = strftime(relative_time(now(), "-" . decrement . "day"), "%F")

Re: I want to replace hard coded text "Today" by current system date in splunk report

avikc100 — Sat, 03 May 2025 13:07:04 GMT

sorry for confusion!

i want system date here in this test area in the dashboard.

Re: I want to replace hard coded text "Today" by current system date in splunk report

ITWhisperer — Sat, 03 May 2025 13:28:30 GMT

Please provide the source code for your dashboard in a code block using the </> button to insert the text.

Re: I want to replace hard coded text "Today" by current system date in splunk report

livehybrid — Sat, 03 May 2025 14:04:36 GMT

Hi @avikc100

Were you able to try my previous example (see below)? If there is an issue with this i'd be happy to try and resolve for you.

Thanks

@livehybrid wrote:
Hi @avikc100
You can create a search that calculates the relevant dates which set tokens and then use the tokens:

Then use $dayMinusN$ for each Title - where N is the number of days, like this:

Below is the full XML example of that dashboard above for you to play with if it helps:

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: I want to replace hard coded text "Today" by current system date in splunk report

yuanliu — Sat, 03 May 2025 16:20:57 GMT

Then, where does the dashboard get those strings? In other words, what is the code in that dashboard that prints those strings?