Splunk Search

How to show custom time for PDF schedule report?

mahesh27
Communicator

Dashboard xml:
I am using this dashboard  to Schedule PDF report, and all panels are showing data for 7 days.
I need to show the time period at the top  of the report like
Time Period: 01-17-2023 to 01-23-2023
how can i do this??

 

 

<dashboard>
<label> Dashboard title</label>
<row>
<panel>
<title>first panel</title>
<single>
<search>
<query>|tstats count as internal_logs where index=_internal
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>second panel</title>
<single>
<search>
<query>|tstats count as audit_logs where index=_audit
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Third panel</title>
<single>
<search>
<query>|tstats count as main_logs where index=main
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>

 

 

 

Labels (1)
Tags (1)
0 Karma

mahesh27
Communicator

Can anyone help on this??

Tags (1)
0 Karma

Thulasinathan_M
Contributor

Hi,
Try something like this, hope it works. You can hide the table and use the token on your panel title.

<row>
    <panel>
      <table depends="$hide$">
        <title>$Time_Period_Start$ $Time_Period_End$</title>
        <search>
          <query>| makeresults
| addinfo
| eval SearchStart = strftime(info_min_time, "%Y-%m-%d %H:%M:%S"), SearchEnd = strftime(info_max_time, "%Y-%m-%d %H:%M:%S")
| table SearchStart, SearchEnd</query>
          <earliest>-7d@d</earliest>
          <latest>@d</latest>
          <done>
            <set token="Time_Period_Start">$result.SearchStart$</set>
            <set token="Time_Period_End">$result.SearchEnd$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>

 

0 Karma

mahesh27
Communicator

Hi @Thulasinathan_M , i tried your xml and generated PDF the  start and end date are showing as Invalid in PDF report.
And moreover can u take my xml and show me how to add tokens to the panels.
so that i can see start and end date in the report.

Tags (1)
0 Karma

Thulasinathan_M
Contributor

Hi,
Have you tried the one I shared, if yes please share me your updated dashboard xml. It's working for me I could see the time on report.

0 Karma

mahesh27
Communicator

Below is the complete xml.
here i am not getting how to add the token values to the other panels in the dashboard.
Can you help me on that


<dashboard>
<label> Dashboard title</label>
<row>
    <panel>
      <table depends="$hide$">
        <title>$Time_Period_Start$ $Time_Period_End$</title>
        <search>
          <query>| makeresults
| addinfo
| eval SearchStart = strftime(info_min_time, "%Y-%m-%d %H:%M:%S"), SearchEnd = strftime(info_max_time, "%Y-%m-%d %H:%M:%S")
| table SearchStart, SearchEnd</query>
          <earliest>-7d@d</earliest>
          <latest>@d</latest>
          <done>
            <set token="Time_Period_Start">$result.SearchStart$</set>
            <set token="Time_Period_End">$result.SearchEnd$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>
<row>
<panel>
<title>first panel</title>
<single>
<search>
<query>|tstats count as internal_logs where index=_internal
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>second panel</title>
<single>
<search>
<query>|tstats count as audit_logs where index=_audit
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Third panel</title>
<single>
<search>
<query>|tstats count as main_logs where index=main
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>



0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...