Splunk Search

Display Date on Dashboard panel

chintan_shah
Path Finder

I want to show the previous week date on Title of panel.
Can anyone have some thoughts for it?

Tags (2)
0 Karma
1 Solution

niketn
Legend

You can run a search to calculate previous week date one of the ways would be through makeresults and using relative_time command.
Then you display the same using HTML panel with formatting of your choice.

  <search>
    <query>| makeresults
| eval prevWeekDate=strftime(relative_time(now(),"-7d"),"%Y/%m/%d")
| table prevWeekDate</query>
    <sampleRatio>1</sampleRatio>
    <preview>
      <set token="tok_Prev_Week_Date">$result.prevWeekDate$</set>
    </preview>
  </search>
  <row>
    <panel>
      <html>
        <div>
          <p style="color:blue;text-align:right;font-size:150%">$tok_Prev_Week_Date$
          </p>
        </div>
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

You can run a search to calculate previous week date one of the ways would be through makeresults and using relative_time command.
Then you display the same using HTML panel with formatting of your choice.

  <search>
    <query>| makeresults
| eval prevWeekDate=strftime(relative_time(now(),"-7d"),"%Y/%m/%d")
| table prevWeekDate</query>
    <sampleRatio>1</sampleRatio>
    <preview>
      <set token="tok_Prev_Week_Date">$result.prevWeekDate$</set>
    </preview>
  </search>
  <row>
    <panel>
      <html>
        <div>
          <p style="color:blue;text-align:right;font-size:150%">$tok_Prev_Week_Date$
          </p>
        </div>
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

chintan_shah
Path Finder

Thanks Niketnilay..so we cannot have dynamic title, but need to include html tags.

0 Karma

niketn
Legend

@chintan_shah... You can print this in Title also. I just used html as an example.

<panel>
   <title>Data from - $tok_Prev_Week_Date$ </title>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...