How to add timerange values to panel content?

aaronkorn · ‎08-05-2014

Has anyone successfully taken the time range values from a timerange picker and passed the human readable format into the title or contents? For example I have a TRP and a single value panel that shows a simple count and then the after label is: "between $time.earliest$ and $time.latest$". This effectively just passes the range i.e. for last 7 days it would read "between -7d@h and now but" would like to see the actual dates. Any ideas on how to do this in simple xml?

wpreston · ‎11-06-2014

I use a single value panel to do this, and have the search results display the earliest and latest search times. Try adding this to your dashboard, it should run anywhere:

...
   <row>
      <panel>
         <single>
            <searchstring>|stats count | addinfo | eval startDate=strftime(info_min_time,"%m/%d/%y @ %l:%M%p") | eval endDate=strftime(info_max_time,"%m/%d/%y @ %l:%M%p") | eval searchTime=startDate+" to "+endDate | stats values(searchTime)</searchstring>
            <earliestTime>$earliest$</earliestTime>
            <latestTime>$latest$</latestTime>
            <option name="underLabel">Is the time period of events in this search</option>
         </single>
      </panel>
   </row>

somesoni2 · ‎08-06-2014

See if this works for you. (run anywhere example)

<form>
  <label>ErrorWarningDistribution</label>
  <fieldset submitButton="False">
    <input type="time">
        <default>Yesterday</default>
    </input>
    <input type="dropdown" token="title" id="field2">
      <selectFirstChoice>true</selectFirstChoice>
      <populatingSearch fieldForValue="title" fieldForLabel="title">
        <![CDATA[
| gentimes start=-1 | addinfo | eval title="between '".strftime(info_min_time,"%F %T")."' and '".strftime(info_max_time,"%F %T")."'"]]>
      </populatingSearch>
    </input>
    <html id="field3">
<style>
.input#field2
{
display:none;
}
</style>      
    </html>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Showing report to period $title$</title>
        <searchString>index=_internal log_level=*
          | chart count(eval(log_level="ERROR")) as ERROR 
          count(eval(log_level="WARN")) as WARNING over date_mday by sourcetype</searchString> 
        <option name="charting.chart">column</option>        
      </chart>
    </panel>
  </row>
</form>

MattZerfas · ‎11-06-2014

Somesoni2 were you ever able to get the issue fixed with it not always updating when the time is changed? What you have here is exactly what I need but I need to have it fully working. Also another note is that this seems to have broken in 6.2.

somesoni2 · ‎08-06-2014

I guess this approach has a issue that the title is not getting updated after changing the time. I will see if I can get that part working.

aaronkorn · ‎08-06-2014

I am on 6.1.2

somesoni2 · ‎08-06-2014

What version of Splunk are you using?

How to add timerange values to panel content?

Announcing Scheduled Export GA for Dashboard Studio

Extending Observability Content to Splunk Cloud

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!