I have a dashboard where all the panels are running for the time period of yesterday. Rather than display the date range for each panel, I'd like to dynamically update the title of the dashboard to include the date range.
I found a few other posts on here that asked something similar but most required tying it to a time picker, which I am not using. Most of the panels are populated by reports. So after reading the various solutions, I thought I could make a dummy search and use the tokens in the title, but my syntax isn't quite working. I also tried getting it to work in the description but that doesn't seem to work either. Either/or would work for me as a solution.
current XML
<dashboard>
<label>$earliest_time$ to $latest_time$</label>
<description>$timelabel$</description>
<search>
<done>
<eval token="earliest_time">strftime(relative_time(now(), $job.request.earliest_time$), "%d %b %T")</eval>
<eval token="latest_time">strftime(relative_time(now(), $job.request.latest_time$), "%d %b %T")</eval>
</done>
<query>|tstats count where index=my_index</query>
<earliest>-1d@d</earliest>
<latest>@d</latest>
<progress>
<set token="timelabel">$result$</set>
</progress>
</search>
</dashboard>
@DEAD_BEEF please try the following code. While you can not use tokens for <label>
and <description>
, you can use hideTitle="true"
to hide the default label and description in the the Splunk Dashboard and then create your own <html>
panel to display custom label and description.
<dashboard hideTitle="true">
<!-- Dashboard <label> and <description> to be hidden through hideTitle attribute -->
<label>Some Dashboard Title</label>
<description>Some Dashboard Description</description>
<!-- Independent Search for setting required tokens -->
<search>
<query>| tstats count where index=_internal</query>
<earliest>-1d@d</earliest>
<latest>@d</latest>
<done>
<eval token="earliest_time">strftime(relative_time(now(), $job.request.earliest_time$), "%d %b %T")</eval>
<eval token="latest_time">strftime(relative_time(now(), $job.request.latest_time$), "%d %b %T")</eval>
</done>
<progress>
<set token="timelabel">$result.count$</set>
</progress>
</search>
<!-- Panel to Show Custom Dashboard Title and Description. CSS Can also be applied as per need -->
<row id="row_custom_header">
<panel>
<html>
<style>
.dashboard-header{
margin-bottom:0px !important;
padding-top:0px !important;
}
#row_custom_header{
position:relative !important;
top:-20px !important;
}
</style>
<div id="custom_header">
<div id="custom_header_title"><h1>$earliest_time$ to $latest_time$</h1></div>
<div id="custom_header_description">$timelabel$</div>
</div>
</html>
</panel>
</row>
</dashboard>
@DEAD_BEEF please try the following code. While you can not use tokens for <label>
and <description>
, you can use hideTitle="true"
to hide the default label and description in the the Splunk Dashboard and then create your own <html>
panel to display custom label and description.
<dashboard hideTitle="true">
<!-- Dashboard <label> and <description> to be hidden through hideTitle attribute -->
<label>Some Dashboard Title</label>
<description>Some Dashboard Description</description>
<!-- Independent Search for setting required tokens -->
<search>
<query>| tstats count where index=_internal</query>
<earliest>-1d@d</earliest>
<latest>@d</latest>
<done>
<eval token="earliest_time">strftime(relative_time(now(), $job.request.earliest_time$), "%d %b %T")</eval>
<eval token="latest_time">strftime(relative_time(now(), $job.request.latest_time$), "%d %b %T")</eval>
</done>
<progress>
<set token="timelabel">$result.count$</set>
</progress>
</search>
<!-- Panel to Show Custom Dashboard Title and Description. CSS Can also be applied as per need -->
<row id="row_custom_header">
<panel>
<html>
<style>
.dashboard-header{
margin-bottom:0px !important;
padding-top:0px !important;
}
#row_custom_header{
position:relative !important;
top:-20px !important;
}
</style>
<div id="custom_header">
<div id="custom_header_title"><h1>$earliest_time$ to $latest_time$</h1></div>
<div id="custom_header_description">$timelabel$</div>
</div>
</html>
</panel>
</row>
</dashboard>
Thank you @niketnilay! I didn't know you couldn't use tokens within the <label>
or <description>
tags. This worked perfectly, I removed the code for the count as all I needed was the date range. Is there a way to limit the width of the row since the date itself doesn't take up the entire row?
@niketnilay, is it possible at all to use this in a scheduled dashboard? I just tried it and it worked nicely in the actual dashboard, but the pdf I received via email (scheduled pdf delivery) did apparently not resolve any of the variables. Is there any hope to get something like this working for the scheduled case?
@pgoldweic I think it may not work for Scheduled dashboard as it has custom CSS and token. You can try once with Smart PDF Exporter for Splunk app, but I have personally not tried that.
@DEAD_BEEF, if you can give id to <panel>
you can set panel width using CSS Override. Refer to answer: https://answers.splunk.com/answers/630436/how-to-change-the-width-of-panels-in-xml.html
However, if you want to utilize the space in panel you can better use position
CSS attribute to place the same at right position. (May be along with float:right
so that this can show up on top-right side of the second panel)
@niketnilay While hiding the default label I am not able to see Edit and Export options.
@nagar57 I have provided an answer to both of your questions.
Do upvoted this answer of it turns out to be helpful for your use case.