Re: How to add timerange values to panel content?

aaronkorn · ‎08-05-2014

Has anyone successfully taken the time range values from a timerange picker and passed the human readable format into the title or contents? For example I have a TRP and a single value panel that shows a simple count and then the after label is: "between $time.earliest$ and $time.latest$". This effectively just passes the range i.e. for last 7 days it would read "between -7d@h and now but" would like to see the actual dates. Any ideas on how to do this in simple xml?

wpreston · ‎11-06-2014

I use a single value panel to do this, and have the search results display the earliest and latest search times. Try adding this to your dashboard, it should run anywhere:

...
   <row>
      <panel>
         <single>
            <searchstring>|stats count | addinfo | eval startDate=strftime(info_min_time,"%m/%d/%y @ %l:%M%p") | eval endDate=strftime(info_max_time,"%m/%d/%y @ %l:%M%p") | eval searchTime=startDate+" to "+endDate | stats values(searchTime)</searchstring>
            <earliestTime>$earliest$</earliestTime>
            <latestTime>$latest$</latestTime>
            <option name="underLabel">Is the time period of events in this search</option>
         </single>
      </panel>
   </row>

somesoni2 · ‎08-06-2014

See if this works for you. (run anywhere example)

<form>
  <label>ErrorWarningDistribution</label>
  <fieldset submitButton="False">
    <input type="time">
        <default>Yesterday</default>
    </input>
    <input type="dropdown" token="title" id="field2">
      <selectFirstChoice>true</selectFirstChoice>
      <populatingSearch fieldForValue="title" fieldForLabel="title">
        <![CDATA[
| gentimes start=-1 | addinfo | eval title="between '".strftime(info_min_time,"%F %T")."' and '".strftime(info_max_time,"%F %T")."'"]]>
      </populatingSearch>
    </input>
    <html id="field3">
<style>
.input#field2
{
display:none;
}
</style>      
    </html>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Showing report to period $title$</title>
        <searchString>index=_internal log_level=*
          | chart count(eval(log_level="ERROR")) as ERROR 
          count(eval(log_level="WARN")) as WARNING over date_mday by sourcetype</searchString> 
        <option name="charting.chart">column</option>        
      </chart>
    </panel>
  </row>
</form>

MattZerfas · ‎11-06-2014

Somesoni2 were you ever able to get the issue fixed with it not always updating when the time is changed? What you have here is exactly what I need but I need to have it fully working. Also another note is that this seems to have broken in 6.2.

somesoni2 · ‎08-06-2014

I guess this approach has a issue that the title is not getting updated after changing the time. I will see if I can get that part working.

aaronkorn · ‎08-06-2014

I am on 6.1.2

somesoni2 · ‎08-06-2014

What version of Splunk are you using?

How to add timerange values to panel content?

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...