- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How do you display the date in a dashboard title?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a dashboard where all the panels are running for the time period of yesterday. Rather than display the date range for each panel, I'd like to dynamically update the title of the dashboard to include the date range.
I found a few other posts on here that asked something similar but most required tying it to a time picker, which I am not using. Most of the panels are populated by reports. So after reading the various solutions, I thought I could make a dummy search and use the tokens in the title, but my syntax isn't quite working. I also tried getting it to work in the description but that doesn't seem to work either. Either/or would work for me as a solution.
current XML
<dashboard>
<label>$earliest_time$ to $latest_time$</label>
<description>$timelabel$</description>
<search>
<done>
<eval token="earliest_time">strftime(relative_time(now(), $job.request.earliest_time$), "%d %b %T")</eval>
<eval token="latest_time">strftime(relative_time(now(), $job.request.latest_time$), "%d %b %T")</eval>
</done>
<query>|tstats count where index=my_index</query>
<earliest>-1d@d</earliest>
<latest>@d</latest>
<progress>
<set token="timelabel">$result$</set>
</progress>
</search>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@DEAD_BEEF please try the following code. While you can not use tokens for <label> and <description>, you can use hideTitle="true" to hide the default label and description in the the Splunk Dashboard and then create your own <html> panel to display custom label and description.
<dashboard hideTitle="true">
<!-- Dashboard <label> and <description> to be hidden through hideTitle attribute -->
<label>Some Dashboard Title</label>
<description>Some Dashboard Description</description>
<!-- Independent Search for setting required tokens -->
<search>
<query>| tstats count where index=_internal</query>
<earliest>-1d@d</earliest>
<latest>@d</latest>
<done>
<eval token="earliest_time">strftime(relative_time(now(), $job.request.earliest_time$), "%d %b %T")</eval>
<eval token="latest_time">strftime(relative_time(now(), $job.request.latest_time$), "%d %b %T")</eval>
</done>
<progress>
<set token="timelabel">$result.count$</set>
</progress>
</search>
<!-- Panel to Show Custom Dashboard Title and Description. CSS Can also be applied as per need -->
<row id="row_custom_header">
<panel>
<html>
<style>
.dashboard-header{
margin-bottom:0px !important;
padding-top:0px !important;
}
#row_custom_header{
position:relative !important;
top:-20px !important;
}
</style>
<div id="custom_header">
<div id="custom_header_title"><h1>$earliest_time$ to $latest_time$</h1></div>
<div id="custom_header_description">$timelabel$</div>
</div>
</html>
</panel>
</row>
</dashboard>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@DEAD_BEEF please try the following code. While you can not use tokens for <label> and <description>, you can use hideTitle="true" to hide the default label and description in the the Splunk Dashboard and then create your own <html> panel to display custom label and description.
<dashboard hideTitle="true">
<!-- Dashboard <label> and <description> to be hidden through hideTitle attribute -->
<label>Some Dashboard Title</label>
<description>Some Dashboard Description</description>
<!-- Independent Search for setting required tokens -->
<search>
<query>| tstats count where index=_internal</query>
<earliest>-1d@d</earliest>
<latest>@d</latest>
<done>
<eval token="earliest_time">strftime(relative_time(now(), $job.request.earliest_time$), "%d %b %T")</eval>
<eval token="latest_time">strftime(relative_time(now(), $job.request.latest_time$), "%d %b %T")</eval>
</done>
<progress>
<set token="timelabel">$result.count$</set>
</progress>
</search>
<!-- Panel to Show Custom Dashboard Title and Description. CSS Can also be applied as per need -->
<row id="row_custom_header">
<panel>
<html>
<style>
.dashboard-header{
margin-bottom:0px !important;
padding-top:0px !important;
}
#row_custom_header{
position:relative !important;
top:-20px !important;
}
</style>
<div id="custom_header">
<div id="custom_header_title"><h1>$earliest_time$ to $latest_time$</h1></div>
<div id="custom_header_description">$timelabel$</div>
</div>
</html>
</panel>
</row>
</dashboard>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you @niketnilay! I didn't know you couldn't use tokens within the <label> or <description> tags. This worked perfectly, I removed the code for the count as all I needed was the date range. Is there a way to limit the width of the row since the date itself doesn't take up the entire row?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@niketnilay, is it possible at all to use this in a scheduled dashboard? I just tried it and it worked nicely in the actual dashboard, but the pdf I received via email (scheduled pdf delivery) did apparently not resolve any of the variables. Is there any hope to get something like this working for the scheduled case?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@pgoldweic I think it may not work for Scheduled dashboard as it has custom CSS and token. You can try once with Smart PDF Exporter for Splunk app, but I have personally not tried that.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@DEAD_BEEF, if you can give id to <panel> you can set panel width using CSS Override. Refer to answer: https://answers.splunk.com/answers/630436/how-to-change-the-width-of-panels-in-xml.html
However, if you want to utilize the space in panel you can better use position CSS attribute to place the same at right position. (May be along with float:right so that this can show up on top-right side of the second panel)
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@niketnilay While hiding the default label I am not able to see Edit and Export options.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@nagar57 I have provided an answer to both of your questions.
Do upvoted this answer of it turns out to be helpful for your use case.
| makeresults | eval message= "Happy Splunking!!!"
Splunk Custom Visualizations App End of Life
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
