Dashboards & Visualizations

How to set a timezone token in a dashboard to display a user's timezone in a time chart?

Path Finder

Hi!

My users often search in either GMT or their local timezone, and it would be good to be able to clearly call out which timezone they're searching with when they load a dashboard, and also to show this timezone on the graphs for when they take screenshots of to send the information to others.

I've got the timezone part figured out, but I need to be able to automatically "set" the $timezone$ token when the page loads.
Here is what I have so far with a radio button input:
.
.

alt text

<input type="radio" token="timezone" searchWhenChanged="true">
  <search>
    <query>* | eval zone=strftime(now(),"%Z %z") | dedup zone | table zone</query>
  </search>
  <fieldForLabel>zone</fieldForLabel>
  <fieldForValue>zone</fieldForValue>
</input>

.
.
And the x-axis label:

  <option name="charting.axisTitleX.text">$timezone$</option>

.
.
Problem
But the $timezone$ token only gets set if a user clicks on the radio button.
This is "O.K." but I figure there's something easy I'm missing.

Does anyone know a way to set the $timezone$ token automatically perhaps with javascript? Can you post a basic example of how to do this? Or perhaps there's a clever way to automatically set the token via SimpleXML?

.
.
Note:
This is similar to this unanswered question:
https://answers.splunk.com/answers/430932/how-do-i-run-a-dashboard-automatically-with-both-1.html

In both cases, I need to automatically set a dashboard token (using a Splunk query) without user input.

Also, I know I could make a xy-series chart with strftime including the timezone for the x-axis time buckets, but I'm looking for a token-based dashboard solution to this question.
.
.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

First of all, don't use * to create dummy events. If you're on recent versions, use | makeresults | eval zone = strftime(_time, "%z"), if you're on older versions use | stats count | eval zone = strftime(now(), "%z").

That being said, you don't actually need an additional search at all with a recent version of Splunk. Add this to your chart's search element:

<search>
  ...
  <preview>
    <eval token="timezone">strftime(time(), "%z")</eval>
  </preview>
</search>

That will set $timezone$ as soon as the search yields a preview.

View solution in original post

SplunkTrust
SplunkTrust

There is a property of the radio form input using which you can select the first radio button values . It's called <selectFirstChoice>. See this for more information.

http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML#input_type_.22r...

Path Finder

This solves this question and also solves the other question over here:
https://answers.splunk.com/answers/430932/how-do-i-run-a-dashboard-automatically-with-both-1.html

If you post the same answer, I'll accept it over at the other question.

0 Karma

Community Manager
Community Manager

Oh woops, sorry I just saw this! I converted your comment on that other post to an answer and accepted it, but if @somesoni2 does post an answer there, I can accept that instead to give him credit. Regardless, karma for all of you 🙂 Thanks @aarontimko for following up with your older question to resolve and close it out.

0 Karma

SplunkTrust
SplunkTrust

First of all, don't use * to create dummy events. If you're on recent versions, use | makeresults | eval zone = strftime(_time, "%z"), if you're on older versions use | stats count | eval zone = strftime(now(), "%z").

That being said, you don't actually need an additional search at all with a recent version of Splunk. Add this to your chart's search element:

<search>
  ...
  <preview>
    <eval token="timezone">strftime(time(), "%z")</eval>
  </preview>
</search>

That will set $timezone$ as soon as the search yields a preview.

View solution in original post

Path Finder

Interesting - this doesn't seem to work with %Z.

<eval token="timezone">strftime(now(),"%Z %z")</eval>
0 Karma