Splunk Search

Display Date on Dashboard panel

chintan_shah
Path Finder

I want to show the previous week date on Title of panel.
Can anyone have some thoughts for it?

Tags (2)
0 Karma
1 Solution

niketn
Legend

You can run a search to calculate previous week date one of the ways would be through makeresults and using relative_time command.
Then you display the same using HTML panel with formatting of your choice.

  <search>
    <query>| makeresults
| eval prevWeekDate=strftime(relative_time(now(),"-7d"),"%Y/%m/%d")
| table prevWeekDate</query>
    <sampleRatio>1</sampleRatio>
    <preview>
      <set token="tok_Prev_Week_Date">$result.prevWeekDate$</set>
    </preview>
  </search>
  <row>
    <panel>
      <html>
        <div>
          <p style="color:blue;text-align:right;font-size:150%">$tok_Prev_Week_Date$
          </p>
        </div>
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

You can run a search to calculate previous week date one of the ways would be through makeresults and using relative_time command.
Then you display the same using HTML panel with formatting of your choice.

  <search>
    <query>| makeresults
| eval prevWeekDate=strftime(relative_time(now(),"-7d"),"%Y/%m/%d")
| table prevWeekDate</query>
    <sampleRatio>1</sampleRatio>
    <preview>
      <set token="tok_Prev_Week_Date">$result.prevWeekDate$</set>
    </preview>
  </search>
  <row>
    <panel>
      <html>
        <div>
          <p style="color:blue;text-align:right;font-size:150%">$tok_Prev_Week_Date$
          </p>
        </div>
      </html>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

chintan_shah
Path Finder

Thanks Niketnilay..so we cannot have dynamic title, but need to include html tags.

0 Karma

niketn
Legend

@chintan_shah... You can print this in Title also. I just used html as an example.

<panel>
   <title>Data from - $tok_Prev_Week_Date$ </title>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...