How to create a dashboard with showing the first and last time of the events

[benspader]

I need to create 2 dashboard panels showing the first and last time of the events being displayed. Has anyone done this? Could you share your simple XML code? I'm trying to do this in Splunk 6.

[emiller42]

I would recommend tackling this using searchPostProcess. Essentially, you have a search that acts as a background search to get your initial data set. Then for each of your dashboard panels, you can use searchPostProcess to append search terms to that master search. This way you can drive multiple visualizations from a single search.

An example which does what you want is here: http://pastebin.com/KfdJjBmS

And this is what it looks like:

Keep in mind, that this may not be the fastest dashboard if your dataset is large.

[ChrisG]

There are some PostProcess docs here: http://docs.splunk.com/Documentation/Splunk/6.0/AdvancedDev/PostProcess