Dashboards & Visualizations

How to display time in panel?

stwong
Communicator

Hello,

I'm writing a simple dashboard with a time picker and some panels.

I try to display the from/to time selected by user in panel header.

It works if user select Date/Time range, but for relative time period (e.g. last 1 day, last 15 minutes), the earliest and latest time are non-numeric values like -d@d, now, etc.

Possible to get the search start/end time for relative time period cases?

Thanks a lot.

Regards

/ST Wong

Labels (1)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

On answer

https://community.splunk.com/t5/Archive/Running-one-of-two-searches-based-on-time-picker-selection/t...

has said

Step 1) Run a dummy search (only use | makeresults to ensure actual index search is not performed) with the time tokens (assuming time picker field name is tokTime) as $tokTime.earliest$ and $tokTime.latest$.

Step 2) Code the Search Event Handler (in the example I have used <done>, <progress> can also be used. These Search Event Handlers can access default search time tokens i.e. $job.earliestTime$ and $job.latestTime$. But in String time format not epoch.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

stwong
Communicator

Hi,

Thanks.  I tried simple code like following but unable to get values in $job.earliestTime$ and $job.latestTime$.   Did i miss anything?

Thanks a lot.

<panel>
<single>
  <title>Total access for department $d_name$ between $job.earliestTime$  and 
 $job.latestTime$ </title>
  <search>
  <query>

[snipped]

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

On answer

https://community.splunk.com/t5/Archive/Running-one-of-two-searches-based-on-time-picker-selection/t...

has said

Step 1) Run a dummy search (only use | makeresults to ensure actual index search is not performed) with the time tokens (assuming time picker field name is tokTime) as $tokTime.earliest$ and $tokTime.latest$.

Step 2) Code the Search Event Handler (in the example I have used <done>, <progress> can also be used. These Search Event Handlers can access default search time tokens i.e. $job.earliestTime$ and $job.latestTime$. But in String time format not epoch.

stwong
Communicator

Hi, thanks for your help.  It works when using with <done>.   

 

Rgds

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...