Show timerange of a search in a dashboard@

[JensT]

Hello,

lets say i have a search like this: "warning earliest=-1d@d+6h latest=@d+6h | table field1, field 2

The resulst is shown as a table in a dashboard.

How can I show the timerange in the widget, so people actually know which timerange this search is covering?

Regards, Jens

[MuS]

Hi JensT,

have a look at this answer http://answers.splunk.com/answers/311712/how-to-produce-a-human-readable-date-from-earliest.html#ans... which shows, how this could be done.

cheers, MuS

[sideview]

I'm not sure if there's a way to do it with just the core UI systems. but if you're using Sideview Utils then you can do this in an advanced XML view:

<module name="HTML" layoutPanel="viewHeader">
  <param name="html"><![CDATA[
    <h3>These $results.count$ results are $results.timeRange.label$</h3>
  ]]></param>
</module>

Sideview Utils does lots of things, one of which is add new and useful $foo$ tokens to use. One of those $foo$ tokens as you see here is $results.timeRange.label$. In this case it will evaluate to "from 6 AM February 23 to 6 AM February 24, 2013".

It's the cousin of a better known Sideview key, $search.timeRange.label$. The difference is the search timerange can be relative or realtime, and it will always try and reflect that label if so. For example it will say "in the last 24 hours", or "during January 2013", or if it has no idea how to put it into words, "over custom relative range").

$results.timeRange.label$ on the other hand will always be the actual absolute-bounded timerange over which the search results came from... in other words the absolute equivalent of the search timerange.

[sideview]

Good news: the answer to that question is fairly simple!

Bad news: You probably wont understand the simple answer to the question until you read the very important page of documentation in Sideview Utils - "overview of the Advanced XML". Look for it under "Key Techniques > Overview of the advanced XML".

Good news again: once you wrap your head around the concepts in that docs page, quite a lot will seem simple!

And the answer: Put that module anywhere at or downstream from the level where the first dispatching module exists, and it will work as expected.

[JensT]

Hi,

thats look very promising, but where would I have to put that snipped?

• Jens