Hi,
I would like to add the time in my panels for my dashboard. I have written the below xml code for it. Do i need to change it.
How to call the token for other panels. I have gone through the documents for couldn't able to find the soution.
Anyone please help me on it.
XML code:
XXX
1
2
3
4
5 <search>
6 <query>| XXX</query>
7 <earliest>-5m</earliest>
8 <latest>now</latest>
9 <done><eval token="lastUpdatedOn"> strftime(now(),"%m/%d/%Y %H:%M:%S") </eval></done>
10 <sampleRatio>1</sampleRatio>
11 <refresh>1m</refresh>
12 <refreshType>delay</refreshType>
13 </search>
14
15
16
If you're looking for a timestamp that gets printed for each of your panels, one way to do it would be to generate a timestamp token, and then add that token to each panel's title. Here is an example:
<form>
<label>Timestamp demo</label>
<fieldset submitButton="false" autoRun="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Last Updated: $timestamp$</title>
<search>
<query>(your search here)</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel depends="$hidden$">
<table>
<search>
<query>| makeresults | eval timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S")</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
<done>
<condition match="$job.doneProgress$=1">
<set token="timestamp">$result.timestamp$</set>
</condition>
</done>
</search>
</table>
</panel>
</row>
</form>
For each panel you want to be annotated with the timestamp, simply edit the XML to have $timestamp$
@kartm you would need to add more details to your question. Meanwhile, you can refer to one of my older answers on similar issue: https://answers.splunk.com/answers/526670/display-datetime-range-in-dashbaord.html
If you're looking for a timestamp that gets printed for each of your panels, one way to do it would be to generate a timestamp token, and then add that token to each panel's title. Here is an example:
<form>
<label>Timestamp demo</label>
<fieldset submitButton="false" autoRun="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Last Updated: $timestamp$</title>
<search>
<query>(your search here)</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel depends="$hidden$">
<table>
<search>
<query>| makeresults | eval timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S")</query>
<earliest>-1s@s</earliest>
<latest>now</latest>
<done>
<condition match="$job.doneProgress$=1">
<set token="timestamp">$result.timestamp$</set>
</condition>
</done>
</search>
</table>
</panel>
</row>
</form>
For each panel you want to be annotated with the timestamp, simply edit the XML to have $timestamp$
Wow great. It worked really. Thank you
I have changed the refresh time as i min in the hidden panel.
This XML code is working. but timestamp is not getting refreshed when i click the refresh button. But when i refresh whole web page it is getting refresh.
Please look into it
Wow great. It worked really. Thank you
I have changed the refresh time as i min in the hidden panel.
Transaction dashboard
<panel>
<title>ERROR</title>
<single>
<title>LAST 5 MINS</title>
<search>
<query>XXX</query>
<earliest>-5m</earliest>
<latest>now</latest>
<done><eval token="lastUpdatedOn"> strftime(now(),"%m/%d/%Y %H:%M:%S") </eval></done>
<sampleRatio>1</sampleRatio>
<refresh>1m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="colorMode">block</option>
<option name="drilldown">all</option>
<option name="rangeColors">["0x53a051","0xf8be34","0xdc4e41"]</option>
<option name="rangeValues">[5,10]</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>
</single>
</panel>
<panel>
where would you like to have the time field, in the panel title or as a column / field in your panel? Both ways are possible
I would like to have it in panel title