Dashboards & Visualizations

How do you display the time range from a report in a dashboard panel?

DEAD_BEEF
Builder

I have a scheduled report that runs everyday at 02:00 AM and gathers statistics for the previous day in a nice table. I have this report displaying the table as a panel in my dashboard.

How do I go about referencing the earliest and latest time of the report in the dashboard panel's title?

Below is what it looks like now and the XML for my dashboard panel

alt text

 <panel>
      <title>This panel powered by scheduled report</title>
      <table>
        <title>Data from $earliest_token$ to $latest_token$</title>
        <search ref="Scheduled Report Test">
          <done>
            <eval token="earliest_token">stftime( relative_time( now(), $job.request.earliest_time$ ),  "%c" )</eval>
            <eval token="latest_token">stftime( relative_time( now(), $job.request.latest_time$ ),  "%c" )</eval>
          </done>
        </search>
        <option name="count">7</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
0 Karma
1 Solution

whrg
Motivator

This might be caused by a typo:
Type strftime instead of stftime in your eval expressions.

View solution in original post

whrg
Motivator

This might be caused by a typo:
Type strftime instead of stftime in your eval expressions.

DEAD_BEEF
Builder

Once again, you solved my problem. Thank you, I spent too many hours going in circles on this. It was just a typo!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...