Getting Data In

Stamping dates onto report PDFs

watsm10
Communicator

Hello,
I'm reasonably new to Splunk. I've created a scheduled search which runs weekly and links to a report showing the number of transactions we made last week. I want to put the "from" and "to" dates of that week in the header of the report, so that it is clear which week the report relates to. All I can get at the moment is the day that the report is printed on. Can anyone help?

lguinn2
Legend

I can't figure out a simple way to do this - but there is a way to show the date range of events that are covered by a search. Assume that your original search looked like this

yoursearchstuffhere
| stats count

Add this to include the date range

yoursearchstuffhere
| stats earliest(_time) as From latest(_time) as To count as "Number of Transactions"
| fieldformat From=strftime(From,"%x %X") 
| fieldformat To=strftime(To,"%x %X") 
Get Updates on the Splunk Community!

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...