Dashboards & Visualizations

How to display time in panel?

stwong
Communicator

Hello,

I'm writing a simple dashboard with a time picker and some panels.

I try to display the from/to time selected by user in panel header.

It works if user select Date/Time range, but for relative time period (e.g. last 1 day, last 15 minutes), the earliest and latest time are non-numeric values like -d@d, now, etc.

Possible to get the search start/end time for relative time period cases?

Thanks a lot.

Regards

/ST Wong

Labels (1)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

On answer

https://community.splunk.com/t5/Archive/Running-one-of-two-searches-based-on-time-picker-selection/t...

has said

Step 1) Run a dummy search (only use | makeresults to ensure actual index search is not performed) with the time tokens (assuming time picker field name is tokTime) as $tokTime.earliest$ and $tokTime.latest$.

Step 2) Code the Search Event Handler (in the example I have used <done>, <progress> can also be used. These Search Event Handlers can access default search time tokens i.e. $job.earliestTime$ and $job.latestTime$. But in String time format not epoch.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

stwong
Communicator

Hi,

Thanks.  I tried simple code like following but unable to get values in $job.earliestTime$ and $job.latestTime$.   Did i miss anything?

Thanks a lot.

<panel>
<single>
  <title>Total access for department $d_name$ between $job.earliestTime$  and 
 $job.latestTime$ </title>
  <search>
  <query>

[snipped]

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

On answer

https://community.splunk.com/t5/Archive/Running-one-of-two-searches-based-on-time-picker-selection/t...

has said

Step 1) Run a dummy search (only use | makeresults to ensure actual index search is not performed) with the time tokens (assuming time picker field name is tokTime) as $tokTime.earliest$ and $tokTime.latest$.

Step 2) Code the Search Event Handler (in the example I have used <done>, <progress> can also be used. These Search Event Handlers can access default search time tokens i.e. $job.earliestTime$ and $job.latestTime$. But in String time format not epoch.

stwong
Communicator

Hi, thanks for your help.  It works when using with <done>.   

 

Rgds

0 Karma
Get Updates on the Splunk Community!

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...