Hi
I'm sure this quite straight forward but what I want to show is the reporting period in title of report or anywhere on the report to be honest!!
So something like: Top 10 User for "1 March 2015 - 31 March 2015"
or
just at the bottom / top corner "1 March 2015 - 31 March 2015"
Hi,
You can use addinfo to get range of time of timerange picker.
Please refere below link for more info.
https://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Addinfo
You can use addinfo in your report search or any separate search.
Please check below code for reference of separate search scenario.
<form>
<label>Test</label>
<search>
<query>| stats count | addinfo | eval endTime=strftime(info_max_time, "%m/%d/%Y %H:%M:%S") | eval startTime=strftime(info_min_time, "%m/%d/%Y %H:%M:%S") </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<preview>
<set token="startTime">$result.startTime$</set>
<set token="endTime">$result.endTime$</set>
</preview>
</search>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Data From: $startTime$ To: $endTime$</title>
<search>
<query>index="_internal" | head 10 | table index source startTime endTime</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<fields>index,source</fields>
</table>
</panel>
</row>
</form>
hi,
try like this:
<form>
<label>Time Picker Form Input Element</label>
<description>Top Sourcetypes by Time Period using Time Picker</description>
<fieldset autoRun="true" submitButton="false">
<input type="time" searchWhenChanged="true">
<label>Select a time:</label>
<default>Last 24 hours</default>
</input>
</fieldset>
<row>
<chart>
<title>top 10 user for $earliest$ and $latest$</title>
<searchString>index=_internal | top limit=100 sourcetype | eval percent = round(percent,2)</searchString>
<option name="charting.chart">pie</option>
</chart>
<table>
<title>top corner for $earliest$ and $latest$</title>
<searchString>index=_internal | top limit=100 sourcetype | eval percent = round(percent,2)</searchString>
</table>
</row>
</form>
Once selected the time you go, it will automatically be added to the header of your title
Hi, I'm using something like that:
<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
<param name="search">index=test-index | head 1 | stats max(_time) as headTime | convert timeformat="%m-%Y" ctime(headTime)</param>
<param name="latest">-0mon@mon</param>
<param name="earliest">-1mon@mon</param>
<module name="SingleValue">
<param name="field">headTime</param>
<param name="classField">low</param>
</module>
</module>
this search let me know the date of the first event.
This i not exaclty what you expect, but I hope that helps.
Cheers,
Olivier
can send full dashboard code,