Getting Data In

Splunk 6.5: How to show the timestamp of the last refresh of a panel?

Communicator

I noticed that in the new version of Splunk, i can choose to autorefresh panels.
So i would like to show when my panel was last refreshed.
For doing so I tried to put the last refresh date in a token but it does not work.

My code:

<panel>
      <title>MAIN</title>
      <table>
        <title>BLA</title>
        <search>
          <query> my query | eval lastRrefresh=strftime(now(),"%Y-%m-%d %H:%M:%S") </query>
          <earliest>0</earliest>
          <latest>now</latest>
          <refresh>$r$</refresh>
          <refreshType>delay</refreshType>
          <done>
            <eval token="time">$result.lastRrefresh$</eval>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">true</option>
        <option name="wrap">true</option>
      </table>
    </panel>

For some reason the token does not get any value.

Can someone understand why?

Is there a better, more simple way of showing the last update of a panel?

Thanks

SplunkTrust
SplunkTrust
0 Karma

SplunkTrust
SplunkTrust

Either you can just use the inbuilt property refresh.time.visible as mentioned in the http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/PanelreferenceforSimplifiedXML#Panel_visualiza...

or

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <search>
          <query>|stats count|eval Message="This is my original search"|table Message</query>
          <done>
            <eval token="time">strftime(now(),"%m/%d/%Y %H:%M:%S")</eval>
          </done>
        </search>
      </table>
      <html>
        <h1>$time$</h1>
      </html>
    </panel>
  </row>
</dashboard>
0 Karma

Communicator

I tried to add the option refresh.time.visible but i can't see any changing in the panel.
Maybe i'm adding the option in the wrong place.

    <panel>
      <title>MAIN</title>
      <table>
        <title>Bla</title>
        <search>
          <query>my query</query>
          <earliest>0</earliest>
          <latest>now</latest>
          <refresh>$r$</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">true</option>
        <option name="wrap">true</option>
        <option name="refresh.time.visible">true</option>
      </table>
    </panel>

thank you

0 Karma

SplunkTrust
SplunkTrust

In this way the refresh time is shown in a little tab in the bottom of the panel only when your mouse pass on the panel.
Bye.
Giuseppe

0 Karma

Communicator

Is there any way to show it in the title without using the token?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!