Splunk Search

How to show custom time for PDF schedule report?

mahesh27
Communicator

Dashboard xml:
I am using this dashboard  to Schedule PDF report, and all panels are showing data for 7 days.
I need to show the time period at the top  of the report like
Time Period: 01-17-2023 to 01-23-2023
how can i do this??

 

 

<dashboard>
<label> Dashboard title</label>
<row>
<panel>
<title>first panel</title>
<single>
<search>
<query>|tstats count as internal_logs where index=_internal
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>second panel</title>
<single>
<search>
<query>|tstats count as audit_logs where index=_audit
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Third panel</title>
<single>
<search>
<query>|tstats count as main_logs where index=main
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>

 

 

 

Labels (1)
Tags (1)
0 Karma

mahesh27
Communicator

Can anyone help on this??

Tags (1)
0 Karma

Thulasinathan_M
Contributor

Hi,
Try something like this, hope it works. You can hide the table and use the token on your panel title.

<row>
    <panel>
      <table depends="$hide$">
        <title>$Time_Period_Start$ $Time_Period_End$</title>
        <search>
          <query>| makeresults
| addinfo
| eval SearchStart = strftime(info_min_time, "%Y-%m-%d %H:%M:%S"), SearchEnd = strftime(info_max_time, "%Y-%m-%d %H:%M:%S")
| table SearchStart, SearchEnd</query>
          <earliest>-7d@d</earliest>
          <latest>@d</latest>
          <done>
            <set token="Time_Period_Start">$result.SearchStart$</set>
            <set token="Time_Period_End">$result.SearchEnd$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>

 

0 Karma

mahesh27
Communicator

Hi @Thulasinathan_M , i tried your xml and generated PDF the  start and end date are showing as Invalid in PDF report.
And moreover can u take my xml and show me how to add tokens to the panels.
so that i can see start and end date in the report.

Tags (1)
0 Karma

Thulasinathan_M
Contributor

Hi,
Have you tried the one I shared, if yes please share me your updated dashboard xml. It's working for me I could see the time on report.

0 Karma

mahesh27
Communicator

Below is the complete xml.
here i am not getting how to add the token values to the other panels in the dashboard.
Can you help me on that


<dashboard>
<label> Dashboard title</label>
<row>
    <panel>
      <table depends="$hide$">
        <title>$Time_Period_Start$ $Time_Period_End$</title>
        <search>
          <query>| makeresults
| addinfo
| eval SearchStart = strftime(info_min_time, "%Y-%m-%d %H:%M:%S"), SearchEnd = strftime(info_max_time, "%Y-%m-%d %H:%M:%S")
| table SearchStart, SearchEnd</query>
          <earliest>-7d@d</earliest>
          <latest>@d</latest>
          <done>
            <set token="Time_Period_Start">$result.SearchStart$</set>
            <set token="Time_Period_End">$result.SearchEnd$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>
<row>
<panel>
<title>first panel</title>
<single>
<search>
<query>|tstats count as internal_logs where index=_internal
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>second panel</title>
<single>
<search>
<query>|tstats count as audit_logs where index=_audit
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Third panel</title>
<single>
<search>
<query>|tstats count as main_logs where index=main
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>



0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...