Getting Data In

Stamping dates onto report PDFs


I'm reasonably new to Splunk. I've created a scheduled search which runs weekly and links to a report showing the number of transactions we made last week. I want to put the "from" and "to" dates of that week in the header of the report, so that it is clear which week the report relates to. All I can get at the moment is the day that the report is printed on. Can anyone help?


Re: Stamping dates onto report PDFs


I can't figure out a simple way to do this - but there is a way to show the date range of events that are covered by a search. Assume that your original search looked like this

| stats count

Add this to include the date range

| stats earliest(_time) as From latest(_time) as To count as "Number of Transactions"
| fieldformat From=strftime(From,"%x %X") 
| fieldformat To=strftime(To,"%x %X")