Dashboards & Visualizations

How do I display _time on dashboard panel's title field?

pshangguan
New Member

Is there a simple way to display _time on the panel title fields? I am tying to create a dashboard and there are no date/time values in the index query, so I want to reply on _time.

Thanks,
Philip

Tags (1)
0 Karma
1 Solution

Vijeta
Influencer

You can have your query assuming you have a status field in event

<panel>
<title>$title$</title>
<search>
<query>
index=<yourindexname> | stats latest(status) as status, latest(_time) as time| fields status time
</query>
<done>
<set token="title">time<set>
</done>

View solution in original post

0 Karma

dstile
Explorer

This may get a little far from your original question, but including it in case it's helpful:

If you are providing a way for your user to select their search times anyway, then you can just use that token elsewhere in your title. Personally I would rather display the end of the search period rather than the last event found. If so, then use the earliest and latest modifiers, for example: $timer_tok.latest$

Alternately if you want to know when the Search Job stopped, try $job.latestTime$

This page has some great token info including both of those examples:
https://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/tokens

0 Karma

Vijeta
Influencer

You can have your query assuming you have a status field in event

<panel>
<title>$title$</title>
<search>
<query>
index=<yourindexname> | stats latest(status) as status, latest(_time) as time| fields status time
</query>
<done>
<set token="title">time<set>
</done>
0 Karma

pshangguan
New Member

I have the following code:

<panel>
  <single>
    <title>$mytitle$</title>
    <search>
      <query>index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-DEV2/" | stats latest(job_result) as status, latest(_time) as time | fields status time</query>
      <done>
        <set token="mytitle">time</set>
      </done>
      <earliest>-4h@m</earliest>
      <latest>now</latest>
    </search>
  </single>
</panel>

I am getting "time" displayed in the panel instead of the actual time. I run the query in splunk search and was able to see the status and the time.

0 Karma

Vijeta
Influencer

Please use below to set the time token. Also you may want to convert your time YYYY/mm/dd h:m:s format before passing it as token

 <set token="mytitle">$result.time$</set>
0 Karma

pshangguan
New Member

That worked. Thanks!!!

0 Karma

Jouman
Path Finder

Hi Pshangguan,

 

After I modity time into $result.time$, the actual time still doesn't appear on the title.

Do you succesfully make the actual time appear in your panel title ?

 

Thanks.

0 Karma

Vijeta
Influencer

Please accept the answer , if it resolved your issue 🙂

0 Karma

marycordova
SplunkTrust
SplunkTrust

latest(_time) as time

@marycordova
0 Karma

Vijeta
Influencer

Sorry was a typo, updated it. Thanks for pointing 🙂

0 Karma

marycordova
SplunkTrust
SplunkTrust

you should convert the comment to an answer 🙂

@marycordova
0 Karma

Vijeta
Influencer

The _time field will be there in your index. You want to display time field for all events or a single event? You can search on index and pass the _time field as token and pass the token to your panel title

0 Karma

pshangguan
New Member

A single event. I am trying to find the latest event and display its status(using single field panel), and I want to use the event time _time and display it in the title field.

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

Do you want the current time to appear on the dashboard or do you need a time from a query?

0 Karma

pshangguan
New Member

I want to catch the event time which I believe is in _time.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...