Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Splunk 6.5: How to show the timestamp of the last ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk 6.5: How to show the timestamp of the last refresh of a panel?
I noticed that in the new version of Splunk, i can choose to autorefresh panels.
So i would like to show when my panel was last refreshed.
For doing so I tried to put the last refresh date in a token but it does not work.
My code:
<panel>
<title>MAIN</title>
<table>
<title>BLA</title>
<search>
<query> my query | eval lastRrefresh=strftime(now(),"%Y-%m-%d %H:%M:%S") </query>
<earliest>0</earliest>
<latest>now</latest>
<refresh>$r$</refresh>
<refreshType>delay</refreshType>
<done>
<eval token="time">$result.lastRrefresh$</eval>
</done>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="rowNumbers">true</option>
<option name="wrap">true</option>
</table>
</panel>
For some reason the token does not get any value.
Can someone understand why?
Is there a better, more simple way of showing the last update of a panel?
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi andreafebbo,
Have you seen this answer?
https://answers.splunk.com/answers/455853/how-to-display-last-refreshedupdated-time-in-dashb.html
bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Either you can just use the inbuilt property refresh.time.visible as mentioned in the http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/PanelreferenceforSimplifiedXML#Panel_visualiza...
or
<dashboard>
<label>test</label>
<row>
<panel>
<table>
<search>
<query>|stats count|eval Message="This is my original search"|table Message</query>
<done>
<eval token="time">strftime(now(),"%m/%d/%Y %H:%M:%S")</eval>
</done>
</search>
</table>
<html>
<h1>$time$</h1>
</html>
</panel>
</row>
</dashboard>
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tried to add the option refresh.time.visible but i can't see any changing in the panel.
Maybe i'm adding the option in the wrong place.
<panel>
<title>MAIN</title>
<table>
<title>Bla</title>
<search>
<query>my query</query>
<earliest>0</earliest>
<latest>now</latest>
<refresh>$r$</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="rowNumbers">true</option>
<option name="wrap">true</option>
<option name="refresh.time.visible">true</option>
</table>
</panel>
thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In this way the refresh time is shown in a little tab in the bottom of the panel only when your mouse pass on the panel.
Bye.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any way to show it in the title without using the token?
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
What’s New & Next in Splunk SOAR
