How to add Clock panels (Dashboard Studio)?

[jmatelun]

Hi! Thanks for your help.

I have a question.

All this in Dashboard Studio.

I need to add a digital clock (hh:mm:ss) to the dashboard, that looks nice and shows me the time in real-time. Also, the dashboard is updated every minute, and we need to show the time (hh:mm:ss) it was updated in another panel (We don't want to use ShowLastUpdated code)

Regards!

[Chef]

Hi Jmatelun,

You can create a SingleValue panel with the following SPL:

| makeresults 1
|  eval timeepoch=now()
|  eval time=strftime(timeepoch,"%H:%M:%S")
|  fields time

Then just add a refresh period in the "options" section like so: 

{
    "type": "ds.search",
    "options": {
        "query": "| makeresults 1\n|  eval timeepoch=now()\n|  eval time=strftime(timeepoch,\"%H:%M:%S\")\n|  fields time",
        "refresh": "1s"
    },
    "name": "Search_1"
}

That should give you a timer that updates every second (I find updating every 3 seconds to be a bit nicer)

Hope this helps!

[denipon]

sorry for resurrecting an old topic, but could you explain, how I adjust the timezones in your solution? I'd like to display the local times of different branches around the world.

[PickleRick]

Splunk renders time in user's configured timezone. So if your user is in CET and has this timezone defined in his profile, all timestamps will be rendered with strftime() in that timezone.

You can't render a timestamp in another timezone.

What you can do (but it's a very ugly hack and I will only tell you an outline, not a detailed recipe) is to calculate an offset from the destination timezone vs. your defined timezone, use this offset to adjust the timestamp and render the timestamp to a string omitting the timezone information and pretend that it's from another timezone. Again - it's a very, very ugly hack and mixing different timezones can lead to confusion so I understand why Splunk doesn't allow you to freely and easily specify timezones. But I can understand that there are use cases when you would like to have multiple timezones (especially when you work with global teams).

The problem with adjusting the original timestamp and pretending it's in another timezone is that if you want to use the value again in your search (for example in a drilldown), you should convert it (remove the offset) again so that it corresponds to the data you have in your index. And that is quickly getting messy, complicated and error-prone.

[denipon]

Thanks for the quick reply.

I'm planning to combine it with the code, for adding a clock panel, written by chef in this topic:

Re: Clock panels (Dashboard Studio) - Splunk Community

and so far my clock only shows time in UTC+0, however i'm in Japan (UTC+9). Maybe this is due to the hack that you described?

Still a complete beginner in SPLUNK, so I'm gonna crack my head tonight about how to code your solution in an SPL query 😄