Dashboard single value sentence including time

[bcarr12]

Hi all,

I'm currently working on a dashboard in Splunk that I am trying to take a count value and include it in a sentence to make it more presentable. As of now, I am able to get a count of events and then create a variable that works great:
eval today=count." "."messages processed today."

I have this dashboard panel set to refresh every hour, so ideally I would like the text to say "xxx messages processed today as of (time most recent search completed)". I've tried creating variables to do this or using by using stats, but any time I include the time in my "today" variable it causes no results to show up. Any thoughts?

[richgalloway]

What is your query?

[cmerriman · Accepted solution]

try something like this:

|eval time=strftime(_time,"%Y-%m-%d %H:%M:%S")| eval today=count+" "+"messages processed"+time+"."

[bcarr12]

I've tried that, but anytime I do my table that used to display the text string returns nothing. Am I doing something in the wrong order?

source="mylog.log" | eval time=strftime(_time,"%I:%M %p") | stats count | eval count=tostring(count, "commas") | eval today=count." "."messages processed today as of"." ".time | table today

[cmerriman]

you need time in your stats command

| eval time=strftime(_time,"%I:%M %p") | stats count max(time) as time| eval count=tostring(count, "commas") | eval today=count." "."messages processed today as of"." ".time| table today

[bcarr12]

Thanks, I made a slight tweak and it is working perfectly now!

source="mylog.log" | eval time=strftime(_time,"%I:%M %p") | stats count latest(time) as time | eval count=tostring(count, "commas") | eval today=count." "."messages processed as of"." ".time | table today