Splunk Search

Dashboard Title - Display date as DD/MM/YYYY

marziaolla
Path Finder

Hello there,
idk how to display the date in the title of the dashboard format as DD/MM/YYYY, not in epoch format
alt text

Here it is the source code:

<form>
  <label>TEST ORA</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <title>$field1.earliest$</title>
      <input type="time" token="field1">
        <label></label>
        <default>
          <earliest>1508450400</earliest>
          <latest>1508623200</latest>
        </default>
      </input>
      <event>
        <search>
          <query>index=test "CURRENT LOGGED USER"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.sortDirection">asc</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

Can someone help me?

TNX 🙂

0 Karma

niketn
Legend

@marziaolla, were you able to try out any of the answers provided below?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@marziaolla, as @cmerriman has pointed out addinfo command is one of the ways to add Search Job Earliest Time and Latest Time. Other option would be to use default tokens for Job which can be accessed in search event handlers. Refer to one of my answers which illustrates both examples. You can use the toking for String Time to display time in String format of your choice(using strftime()) instead of epoch time.

https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cmerriman
Super Champion

try doing this:

<form>
   <label>TEST ORA</label>
   <fieldset submitButton="false"></fieldset>
   <row>
     <panel>
       <title>$timelabel$</title>
       <input type="time" token="field1">
         <label></label>
         <default>
           <earliest>1508450400</earliest>
           <latest>1508623200</latest>
         </default>
       </input>
<search>
    <query>|makeresults|addinfo</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
          <progress>
            <eval token="timelabel">strftime($result.info_min_time$,"%d/%m/%Y")</eval>
          </progress>
  </search>
       <event>
         <search>
           <query>index=test "CURRENT LOGGED USER"</query>
           <earliest>$field1.earliest$</earliest>
           <latest>$field1.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="count">50</option>
         <option name="list.drilldown">none</option>
         <option name="list.wrap">1</option>
         <option name="maxLines">5</option>
         <option name="raw.drilldown">full</option>
         <option name="rowNumbers">0</option>
         <option name="table.drilldown">all</option>
         <option name="table.sortDirection">asc</option>
         <option name="table.wrap">1</option>
         <option name="type">list</option>
       </event>
     </panel>
   </row>
 </form>
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...