Splunk Search

How to color a panel if the result is not equal a specific datetime ?

mah
Builder

Hi, 

My issue is : 

I have a panel like that :

mah_0-1597133068884.png

what I want is to change dynamically the color (red for example) when this is not equal to the curent time. 

I have my request like this : 

index=abc
| stats count by Timestamp
| eval epochtime=strptime(Timestamp, "%Y-%m-%dT%H:%M:%S.%N")| eval desired_time=strftime(epochtime, "%d/%m/%Y %H:%M:%S")
| rename desired_time as timestamp
| fields timestamp
| sort timestamp desc
| eval now = now()
| fieldformat now = strftime(now, "%d/%m/%Y %H:%M:%S")
| head 1
| where timestamp<now

The format option is not useful in this case. 

How can I do this ? 

Thanks !

 

Tags (1)
0 Karma

mah
Builder

Can someone help me for this case please ?

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...