Show Date Value in Label or in Legend

[selva1709]

Hello Experts,

Greetings! I am new to Splunk and I have created Dashboard which will show the CPU Utilization value for two different time frames for the single server. Data is showing correctly as expected by I need to show "Date" in Legend values. For example: Time period1 indicates Aug 3rd, 2020 (from 5AM to 7AM) and Time period2 indicates Aug 4th, 2020 (from 5AM to 7AM). I need to show Aug 3, 2020 for Time Period1 and show Aug 4, 2020 for Time Period2.

Please find my code and snapshot below for more details:

<form>
   <label>Working Report</label>
   <fieldset submitButton="false">
      <input type="dropdown" token="iSeries" searchWhenChanged="true">
         <label>iSeries Host</label>
         <search>
            <query>index=application_name sourcetype="eview-iSeries" | stats values(host) by host</query>
            <earliest>$time_period1.earliest$</earliest>
            <latest>$time_period1.latest$</latest>
         </search>
         <search>
            <query>index=application_name sourcetype="eview-iSeries" | stats values(host) by host</query>
            <earliest>$time_period2.earliest$</earliest>
            <latest>$time_period2.latest$</latest>
         </search>
         <fieldForLabel>host</fieldForLabel>
         <fieldForValue>host</fieldForValue>
      </input>
      <input type="time" token="time_period1">
         <label>Time Period1</label>
         <default>
            <earliest>-24h@h</earliest>
            <latest>now</latest>
         </default>
      </input>
      <input type="time" token="time_period2">
         <label>Time Period2</label>
         <default>
            <earliest>@d</earliest>
            <latest>now</latest>
         </default>
      </input>
   </fieldset>
   <row>
      <panel>
         <chart>
            <title>CPU Utilization</title>
            <search>
               <query>index=application_name sourcetype="eview-iSeries" host=$iSeries$ earliest=$time_period1.earliest$ latest=$time_period1.latest$ | timechart span=5min avg("AvgPercentCPUUsed") as "Time Period1" | appendcols [search index=application_name sourcetype="eview-iSeries" host=$iSeries$ earliest=$time_period2.earliest$ latest=$time_period2.latest$ | timechart span=5min avg("AvgPercentCPUUsed") as "Time Period2"] | convert timeformat=""%H:%M"" ctime(_time) AS Time | sort _time | fields - _time | table Time *</query>
            </search>
            <option name="charting.chart">line</option>
            <option name="charting.seriesColors">[0xFF0000,0x0000FF]</option>
            <option name="charting.chart.columnSpacing">100</option>
         </chart>
      </panel>
   </row>
</form>

[niketn · Accepted solution]

@selva1709 if SPL is working as expected and you just need to show YYY-mm-dd format time based on Time Picker input, you can either use <eval> on time input <change> event handler or else use an independent search with the time input which sets required time token using search event handler. Both examples you can find in one of my older answer: https://community.splunk.com/t5/Archive/Running-one-of-two-searches-based-on-time-picker-selection/t...

[selva1709]

Hello niketnilay,

Thanks for sharing your comments. I have gone through your old post and I am able to find the solution for my queries 🙂

You are champ 🙂

Regards,

Selvaganesh E