Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- how to add couple of data value in a dashboard
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how to add couple of data value in a dashboard
Hi
I have a dashboard created with a PIE chart. I want to add on the dashboard start and end time for which this pie chart is created. Let us say this chart is created for doing a 24 hrs data analysis and creating the PIE chart.
Start time : now-24h End Time: Now displayed above the Pie chart.
if that is not possible at least I need that start and end time printed on somewhere in the chart when I send it as email PDF to clients. so they know this report is for the data period starting and ending used
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use | addinfo to create info_min_time and info_max_time fields and create tokens and then use these in the title of the dashboard panel with My panel name from $info_min_time$ to $info_max_time$.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
as you can see at https://docs.splunk.com/Documentation/Splunk/7.3.2/Viz/tokens , you can use the search tokens $job.earliestTime$ and $job.latestTime$ to add start and end time to one of the panel's title or to an html box, in the following example I added to both of them.
Something like this:
<form>
<label>test</label>
<search>
<query>| makeresults
</query>
<earliest>$Time.earliest$</earliest>
<latest>$Time.latest$</latest>
<done>
<eval token="earliestTime">$job.earliestTime$</eval>
<eval token="latestTime">$job.latestTime$</eval>
</done>
</search>
<fieldset submitButton="false">
<input type="time" token="Time">
<label>Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</input>
</fieldset>
<row>
<html>
Date & Time Range Between: $earliestTime$ and $latestTime$
</html>
</row>
<row>
<panel>
<title>$earliestTime$ - $latestTime$</title>
<event>
<search>
<query>index=...</query>
<earliest>$Time.earliest$</earliest>
<latest>$Time.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="list.drilldown">none</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">all</option>
<option name="table.sortDirection">asc</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
</event>
</panel>
</row>
</form>
Ciao.
Giuseppe
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
