Splunk Search

Dashboard Title - Display date as DD/MM/YYYY

marziaolla
Path Finder

Hello there,
idk how to display the date in the title of the dashboard format as DD/MM/YYYY, not in epoch format
alt text

Here it is the source code:

<form>
  <label>TEST ORA</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <title>$field1.earliest$</title>
      <input type="time" token="field1">
        <label></label>
        <default>
          <earliest>1508450400</earliest>
          <latest>1508623200</latest>
        </default>
      </input>
      <event>
        <search>
          <query>index=test "CURRENT LOGGED USER"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">50</option>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.sortDirection">asc</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

Can someone help me?

TNX 🙂

0 Karma

niketn
Legend

@marziaolla, were you able to try out any of the answers provided below?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@marziaolla, as @cmerriman has pointed out addinfo command is one of the ways to add Search Job Earliest Time and Latest Time. Other option would be to use default tokens for Job which can be accessed in search event handlers. Refer to one of my answers which illustrates both examples. You can use the toking for String Time to display time in String format of your choice(using strftime()) instead of epoch time.

https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cmerriman
Super Champion

try doing this:

<form>
   <label>TEST ORA</label>
   <fieldset submitButton="false"></fieldset>
   <row>
     <panel>
       <title>$timelabel$</title>
       <input type="time" token="field1">
         <label></label>
         <default>
           <earliest>1508450400</earliest>
           <latest>1508623200</latest>
         </default>
       </input>
<search>
    <query>|makeresults|addinfo</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
          <progress>
            <eval token="timelabel">strftime($result.info_min_time$,"%d/%m/%Y")</eval>
          </progress>
  </search>
       <event>
         <search>
           <query>index=test "CURRENT LOGGED USER"</query>
           <earliest>$field1.earliest$</earliest>
           <latest>$field1.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="count">50</option>
         <option name="list.drilldown">none</option>
         <option name="list.wrap">1</option>
         <option name="maxLines">5</option>
         <option name="raw.drilldown">full</option>
         <option name="rowNumbers">0</option>
         <option name="table.drilldown">all</option>
         <option name="table.sortDirection">asc</option>
         <option name="table.wrap">1</option>
         <option name="type">list</option>
       </event>
     </panel>
   </row>
 </form>
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...