Reporting

How to add search timeframe to a report results?

kearaspoor
Communicator

I have a search that is correctly generating a report that contains just a table, no charts, and no event timestamps.

I need to be able to add the search timeframe parameter somewhere in the results. Either as part of the report name, or as a comment/legend/footnote.

So, if the search spans the previous month, I need something like:

ReportName - mm/dd/yy to mm/dd/yy.

Any suggestions?

Tags (3)
0 Karma
1 Solution

HiroshiSatoh
Champion

I can be set in this period if the search time range picker.
However, it is added to all the results.

(your search)|addinfo | eval ReportName =strftime(info_min_time,"%y/%m/%d")."To".strftime(info_max_time,"%y/%m/%d")

If you want to add only one line
(your search)|append [| stats count |addinfo | eval ReportName =strftime(info_min_time,"%y/%m/%d")."To".strftime(info_max_time,"%y/%m/%d") ]

View solution in original post

0 Karma

HiroshiSatoh
Champion

I can be set in this period if the search time range picker.
However, it is added to all the results.

(your search)|addinfo | eval ReportName =strftime(info_min_time,"%y/%m/%d")."To".strftime(info_max_time,"%y/%m/%d")

If you want to add only one line
(your search)|append [| stats count |addinfo | eval ReportName =strftime(info_min_time,"%y/%m/%d")."To".strftime(info_max_time,"%y/%m/%d") ]

0 Karma

kearaspoor
Communicator

Thank you! That worked wonderfully!

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...