Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Time picker shows up in the dashboard panel
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Time picker shows up in the dashboard panel
I have a time picker on my dashboard where I select between (start - end) time range. My dashboard populates all the panels. My dashboard has 6 panels. I want to see that time in a panel on my dashboard. If I add a panel it wants me to select a panel type (what type do I need?) My time picker has the token "Time" and it is shared to all panels. How do I get the time select in the time picker to be on the dashboard (new Panel) so that it shows up in my pdf report?
Thank You
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Have you tried displaying the token values in a HTML panel?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It does not refresh
<form>
<label>HD MAIL - TEST</label>
<fieldset submitButton="true" autoRun="false">
<input type="time" token="time">
<label>time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
<change>
<eval token="timelabel_earliest">if(isnum($time.earliest$), strftime($time.earliest$,"%m/%d/%Y %H:%M"), strftime(relative_time(now(), $time.earliest$),"%m/%d/%Y %H:%M") )</eval>
<eval token="timelabel_latest">if(isnum($time.latest$), strftime($time.latest$,"%m/%d/%Y %H:%M"), strftime(relative_time(now(), $time.latest$), "%m/%d/%Y %H:%M") )</eval>
</change>
</input>
<input type="text" token="merchID">
<label>Merchant ID</label>
</input>
</fieldset>
<row>
<panel>
<html>
<!-- <h1>Date Range for this Alert: $time.earliest$ - $time.latest$ </h1> -->
<h1>Date Range for this Alert: $timelabel_earliest$ - $timelabel_latest$ </h1>
</html>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I'd wanted a similar thing for a dashboard and the following way had worked for me:
<row depends="$hidden$">
<panel>
<table>
<search>
<done>
<set token="tkn_display_earliest">$result.earliest$</set>
<set token="tkn_display_latest">$result.latest$</set>
</done>
<query>| stats count
| eval earliest= replace("$time.earliest$","rt","")
| eval earliest = if(earliest!="",earliest,0)
| eval earliest=strftime(if(replace(replace(earliest,"\.\d+",""),"\d","")!="",relative_time(now(),earliest),earliest), "%b %d %Y %H:%M:%S")
| eval latest=strftime(if(replace(replace("$time.latest$","\.\d+",""),"\d","")!="",relative_time(now(),if("$time.latest$"="now" OR "$time.latest$"="rt" , "-0", "$time.latest$")),"$time.latest$"), "%b %d %Y %H:%M:%S")
| eval latest = if(isnull(latest), strftime(now(),"%b %d %Y %H:%M:%S"), latest)</query>
<earliest>$timeRange.earliest$</earliest>
<latest>$timeRange.latest$</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<html>
<h1>Time: $tkn_display_earliest$ - $tkn_display_latest$</h1>
</html>
</row>
Splunk Observability for AI
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability as Code: From Zero to Dashboard
