All Apps and Add-ons

How to display earliest and latest dates of searches in a dashboard and PDF report?

Path Finder


How do you display the earliest and latest dates of the searches in a dashboard that is later rendered into a PDF report?

This report gets mailed out once a week and with no earliest and latest dates it is pretty tough to keep track of them.

Thank you



If, like me, you don't want that information into a table but want to display it in some HTML or in the title of panels, edit the xml and locate the ... block. Witin it add a "done" clause like in this example:

  <query> ... </query>
  <earliest> ... </earliest>
  <latest> ... </latest>
    <eval token="earliest_token"> stftime( relative_time( now(), $job.request.earliest_time$ ),  "%c" ) </eval>
    <eval token="latest_token"> stftime( relative_time( now(), $job.request.latest_time$ ),  "%c" ) </eval>

Then you can do things like:

      <p>Showing data from $earliest_token$ to $latest_token$.</p>

There is many ways this can be tweaked to your preference, starting with the format you give to strftime. This example assumes that the earliest/latest are relative times such as "-7d@d" etc. You'll need to update the eval if they are epoch timestamps for instance.

Also, I'm using this with a base search at the top of the dashboard (outside any panel). If you're trying this with a search within a panel, I'm not a 100% sure the tokens will be available everywhere in the dashboard.

One slight annoyance with this solution is that the earliest/latest tokens are not populated until the search is done, but I haven't found how to avoid that. Works for me anyway.


Unfortunately, that works for the dashboard but not for the scheduled PDF 😞

0 Karma


you could add a table showing the min and max _time, like that:

index=main | stats min(_time) AS startDate, max(_time) AS endDate | convert timeformat="%F %T" ctime(*Date)

Just add it as another element to the Dashboard in a table format.

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>