Dashboards & Visualizations

In Splunk dashboard, how can I get todays date as default value in string?

Chandras11
Communicator

Hi All,

I have a dashboard and text input to provide the date as the "YYYY-MM-DD" (For example 2018-06-15) format.
However, for the default value, I have given a static value. I want to get today's date in the default value (with now() function). However, Splunk tells that a query is not possible in the default field. Can anyone please tell me, how can I put today's date in the default value.

" fieldset autoRun="true" submitButton="false">
    input type="text" token="Year_Month_Day_t">
     label>Enter the date as YYYY-MM-DD 
     /label>
      default>2018-06-15 /default>
    /input>
  /fieldset "

P:S. I removed the first < in all tags (for example fieldset, input type, label, default, etc) as Splunk answer was not letting me paste the codes with tags. My concern is for default>2018-06-15 /default> where I want to give today's date from the system.

Thanks a lot for the help.

0 Karma
1 Solution

renjith_nair
Legend

Try this

<form>
  <search>
    <query>| makeresults|eval today=strftime(_time,"%Y-%m-%d")|fields - _time</query>
    <done>
      <set token="defaut_time">$result.today$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="text" token="field1">
      <label>field1</label>
      <default>$defaut_time$</default>
    </input>
  </fieldset>
</form>

Run a dummy search and set a token and use the token in default field

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

Try this

<form>
  <search>
    <query>| makeresults|eval today=strftime(_time,"%Y-%m-%d")|fields - _time</query>
    <done>
      <set token="defaut_time">$result.today$</set>
    </done>
  </search>
  <fieldset submitButton="false">
    <input type="text" token="field1">
      <label>field1</label>
      <default>$defaut_time$</default>
    </input>
  </fieldset>
</form>

Run a dummy search and set a token and use the token in default field

---
What goes around comes around. If it helps, hit it with Karma 🙂

Chandras11
Communicator

Thanks a lot. I already have a query where I am calculating todays date. Let me check it in my code 🙂

0 Karma

Chandras11
Communicator

Working like a charm 🙂 now I can easily put relative time, current week, month etc : ) just a small modification can be : eval today=strftime(now(),"%Y-%m-%d")

0 Karma
Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...