All Apps and Add-ons

How to create a dashboard with showing the first and last time of the events

benspader
Explorer

I need to create 2 dashboard panels showing the first and last time of the events being displayed. Has anyone done this? Could you share your simple XML code? I'm trying to do this in Splunk 6.

emiller42
Motivator

I would recommend tackling this using searchPostProcess. Essentially, you have a search that acts as a background search to get your initial data set. Then for each of your dashboard panels, you can use searchPostProcess to append search terms to that master search. This way you can drive multiple visualizations from a single search.

An example which does what you want is here: http://pastebin.com/KfdJjBmS

And this is what it looks like:

screenshot

Keep in mind, that this may not be the fastest dashboard if your dataset is large.

ChrisG
Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...