Displaying Dynamic date in Simple XML dashboard

[coleman07]

I created a dashboard using Simple XML under Splunk 6. I created a search "* | stats count | addinfo | eval date=strftime(info_min_time,"%B %d %Y") | fields date" and currently use a single value box. I would prefer to put that date at the top of the dashboard in the label. I need to use Simple XML so I can email the report daily to the end user.

[gauldridge]

You won't be able to change the <label></label> value that populates the form/dashboard title using Simple XML. However, you can change the value that populates the title of a panel if you convert to using a form search. Here's a working example:

<form>
  <label>Splunk Answers (125114) Example</label>
  <fieldset autoRun="false" submitButton="false">
    <input type="text" token="name">
      <label>Command:</label>
      <default>*</default>
      <suffix>*</suffix>
    </input>

    <input type="dropdown" token="begin" searchWhenChanged="true">
      <label>Choose Start Date:</label>
      <populatingSearch fieldForLabel="day" fieldForValue="day">
        sourcetype="syslog" | bucket span=1d _time AS day | dedup day | sort -day | convert timeformat="%B %d %Y" ctime(day)
      </populatingSearch>
      <default></default>
    </input>

  </fieldset>
  <row>
    <table>
      <title>syslog "COMMANDS" since $begin$</title>
      <searchString>sourcetype="syslog" [|gentimes start=-1 | eval earliest=strptime("$begin$","%B %d %Y") | fields earliest] | search COMMAND="$name$"</searchString>
      <option name="count">5</option>
      <option name="wrap">true</option>
      <option name="dataOverlayMode">none</option>
      <option name="drilldown">row</option>
    </table>
  </row>
</form>

Basically, I created a dropdown that replaces the time picker and allows you to choose the start date for your form. You can use the time picker and it's $earliest$ token instead but the value placed into $earliest$ will be something like -30d@d which isn't helpful as the date to be displayed in the panel title.

If you need to specify a start time different from some day at midnight, you'll just have to be sure you also modify the strptime() parameters. Also, it would be simple to add a second dropdown to specify the ending date/time. Alertantively, you could add a time picker and use the $earliest$ and $latest$ tokens created by the time picker to set bounds on the date dropdown.

But the bottom line is that you can't change the title of the form/dashboard using Simple XML.