All Apps and Add-ons

How to create a dashboard with showing the first and last time of the events

benspader
Explorer

I need to create 2 dashboard panels showing the first and last time of the events being displayed. Has anyone done this? Could you share your simple XML code? I'm trying to do this in Splunk 6.

emiller42
Motivator

I would recommend tackling this using searchPostProcess. Essentially, you have a search that acts as a background search to get your initial data set. Then for each of your dashboard panels, you can use searchPostProcess to append search terms to that master search. This way you can drive multiple visualizations from a single search.

An example which does what you want is here: http://pastebin.com/KfdJjBmS

And this is what it looks like:

screenshot

Keep in mind, that this may not be the fastest dashboard if your dataset is large.

ChrisG
Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...