Using Splunk Enterprise 9.4
I have created a data source name TimeRange with the SPL Query:
| makeresults
| addinfo
| eval t1=strftime(info_min_time,"%Y-%m-%d %H:%M")
| eval t2=strftime(info_max_time,"%Y-%m-%d %H:%M")
| table t1, t2
I have created a Markdown panel with content
**Last Updated:** $LastUpdatedBaseSearch:result.friendlyTime$ **[$BaseSearch:job.status$]**
**Time Range:** $TimeRange.t1$ to $TimeRange.t2$
For some reason the range is not showing
I did just notice that the Data Source says unused. So is it not being run when the Dashboard is refreshed? All my other charts use a chain search with the BaseSearch as their parent.
Sorry folks, I just figured it out.
Change the Markdown to:
**Last Updated:** $LastUpdatedBaseSearch:result.friendlyTime$ **[$BaseSearch:job.status$]**
**Time Range:** $TimeRange:result.t1$ to $TimeRange:result.t2$
Also I check the checkbox for the TimeRange search to Access search results or metadata
Sorry folks, I just figured it out.
Change the Markdown to:
**Last Updated:** $LastUpdatedBaseSearch:result.friendlyTime$ **[$BaseSearch:job.status$]**
**Time Range:** $TimeRange:result.t1$ to $TimeRange:result.t2$
Also I check the checkbox for the TimeRange search to Access search results or metadata