Getting Data In

Splunk 6.5: How to show the timestamp of the last refresh of a panel?

andreafebbo
Communicator

I noticed that in the new version of Splunk, i can choose to autorefresh panels.
So i would like to show when my panel was last refreshed.
For doing so I tried to put the last refresh date in a token but it does not work.

My code:

<panel>
      <title>MAIN</title>
      <table>
        <title>BLA</title>
        <search>
          <query> my query | eval lastRrefresh=strftime(now(),"%Y-%m-%d %H:%M:%S") </query>
          <earliest>0</earliest>
          <latest>now</latest>
          <refresh>$r$</refresh>
          <refreshType>delay</refreshType>
          <done>
            <eval token="time">$result.lastRrefresh$</eval>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">true</option>
        <option name="wrap">true</option>
      </table>
    </panel>

For some reason the token does not get any value.

Can someone understand why?

Is there a better, more simple way of showing the last update of a panel?

Thanks

gcusello
SplunkTrust
SplunkTrust
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Either you can just use the inbuilt property refresh.time.visible as mentioned in the http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/PanelreferenceforSimplifiedXML#Panel_visualiza...

or

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <search>
          <query>|stats count|eval Message="This is my original search"|table Message</query>
          <done>
            <eval token="time">strftime(now(),"%m/%d/%Y %H:%M:%S")</eval>
          </done>
        </search>
      </table>
      <html>
        <h1>$time$</h1>
      </html>
    </panel>
  </row>
</dashboard>
Happy Splunking!
0 Karma

andreafebbo
Communicator

I tried to add the option refresh.time.visible but i can't see any changing in the panel.
Maybe i'm adding the option in the wrong place.

    <panel>
      <title>MAIN</title>
      <table>
        <title>Bla</title>
        <search>
          <query>my query</query>
          <earliest>0</earliest>
          <latest>now</latest>
          <refresh>$r$</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">true</option>
        <option name="wrap">true</option>
        <option name="refresh.time.visible">true</option>
      </table>
    </panel>

thank you

0 Karma

gcusello
SplunkTrust
SplunkTrust

In this way the refresh time is shown in a little tab in the bottom of the panel only when your mouse pass on the panel.
Bye.
Giuseppe

0 Karma

andreafebbo
Communicator

Is there any way to show it in the title without using the token?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...