How do I display _time on dashboard panel's title field?

[pshangguan]

Is there a simple way to display _time on the panel title fields? I am tying to create a dashboard and there are no date/time values in the index query, so I want to reply on _time.

Thanks,
Philip

[dstile]

This may get a little far from your original question, but including it in case it's helpful:

If you are providing a way for your user to select their search times anyway, then you can just use that token elsewhere in your title. Personally I would rather display the end of the search period rather than the last event found. If so, then use the earliest and latest modifiers, for example: $timer_tok.latest$

Alternately if you want to know when the Search Job stopped, try $job.latestTime$

This page has some great token info including both of those examples:
https://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/tokens

[Vijeta · Accepted solution]

You can have your query assuming you have a status field in event

<panel>
<title>$title$</title>
<search>
<query>
index=<yourindexname> | stats latest(status) as status, latest(_time) as time| fields status time
</query>
<done>
<set token="title">time<set>
</done>

[pshangguan]

I have the following code:

<panel>
  <single>
    <title>$mytitle$</title>
    <search>
      <query>index=jenkins |spath job_name | search job_name="job/utl-dataflow-check-DEV2/" | stats latest(job_result) as status, latest(_time) as time | fields status time</query>
      <done>
        <set token="mytitle">time</set>
      </done>
      <earliest>-4h@m</earliest>
      <latest>now</latest>
    </search>
  </single>
</panel>

I am getting "time" displayed in the panel instead of the actual time. I run the query in splunk search and was able to see the status and the time.

[Vijeta]

Please use below to set the time token. Also you may want to convert your time YYYY/mm/dd h:m:s format before passing it as token

 <set token="mytitle">$result.time$</set>

[pshangguan]

That worked. Thanks!!!

[Jouman]

Hi Pshangguan,

After I modity time into $result.time$, the actual time still doesn't appear on the title.

Do you succesfully make the actual time appear in your panel title ?

Thanks.

[Vijeta]

Please accept the answer , if it resolved your issue 🙂

[marycordova]

latest(_time) as time

[Vijeta]

Sorry was a typo, updated it. Thanks for pointing 🙂

[marycordova]

you should convert the comment to an answer 🙂

[Vijeta]

The _time field will be there in your index. You want to display time field for all events or a single event? You can search on index and pass the _time field as token and pass the token to your panel title

[pshangguan]

A single event. I am trying to find the latest event and display its status(using single field panel), and I want to use the event time _time and display it in the title field.

[msivill_splunk]

Do you want the current time to appear on the dashboard or do you need a time from a query?

[pshangguan]

I want to catch the event time which I believe is in _time.