Getting Data In

Splunk 6.5: How to show the timestamp of the last refresh of a panel?

andreafebbo
Communicator

I noticed that in the new version of Splunk, i can choose to autorefresh panels.
So i would like to show when my panel was last refreshed.
For doing so I tried to put the last refresh date in a token but it does not work.

My code:

<panel>
      <title>MAIN</title>
      <table>
        <title>BLA</title>
        <search>
          <query> my query | eval lastRrefresh=strftime(now(),"%Y-%m-%d %H:%M:%S") </query>
          <earliest>0</earliest>
          <latest>now</latest>
          <refresh>$r$</refresh>
          <refreshType>delay</refreshType>
          <done>
            <eval token="time">$result.lastRrefresh$</eval>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">true</option>
        <option name="wrap">true</option>
      </table>
    </panel>

For some reason the token does not get any value.

Can someone understand why?

Is there a better, more simple way of showing the last update of a panel?

Thanks

gcusello
SplunkTrust
SplunkTrust
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Either you can just use the inbuilt property refresh.time.visible as mentioned in the http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/PanelreferenceforSimplifiedXML#Panel_visualiza...

or

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <search>
          <query>|stats count|eval Message="This is my original search"|table Message</query>
          <done>
            <eval token="time">strftime(now(),"%m/%d/%Y %H:%M:%S")</eval>
          </done>
        </search>
      </table>
      <html>
        <h1>$time$</h1>
      </html>
    </panel>
  </row>
</dashboard>
Happy Splunking!
0 Karma

andreafebbo
Communicator

I tried to add the option refresh.time.visible but i can't see any changing in the panel.
Maybe i'm adding the option in the wrong place.

    <panel>
      <title>MAIN</title>
      <table>
        <title>Bla</title>
        <search>
          <query>my query</query>
          <earliest>0</earliest>
          <latest>now</latest>
          <refresh>$r$</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">true</option>
        <option name="wrap">true</option>
        <option name="refresh.time.visible">true</option>
      </table>
    </panel>

thank you

0 Karma

gcusello
SplunkTrust
SplunkTrust

In this way the refresh time is shown in a little tab in the bottom of the panel only when your mouse pass on the panel.
Bye.
Giuseppe

0 Karma

andreafebbo
Communicator

Is there any way to show it in the title without using the token?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...