Splunk Search

How to show custom time for PDF schedule report?

mahesh27
Communicator

Dashboard xml:
I am using this dashboard  to Schedule PDF report, and all panels are showing data for 7 days.
I need to show the time period at the top  of the report like
Time Period: 01-17-2023 to 01-23-2023
how can i do this??

 

 

<dashboard>
<label> Dashboard title</label>
<row>
<panel>
<title>first panel</title>
<single>
<search>
<query>|tstats count as internal_logs where index=_internal
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>second panel</title>
<single>
<search>
<query>|tstats count as audit_logs where index=_audit
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Third panel</title>
<single>
<search>
<query>|tstats count as main_logs where index=main
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>

 

 

 

Labels (1)
Tags (1)
0 Karma

mahesh27
Communicator

Can anyone help on this??

Tags (1)
0 Karma

Thulasinathan_M
Contributor

Hi,
Try something like this, hope it works. You can hide the table and use the token on your panel title.

<row>
    <panel>
      <table depends="$hide$">
        <title>$Time_Period_Start$ $Time_Period_End$</title>
        <search>
          <query>| makeresults
| addinfo
| eval SearchStart = strftime(info_min_time, "%Y-%m-%d %H:%M:%S"), SearchEnd = strftime(info_max_time, "%Y-%m-%d %H:%M:%S")
| table SearchStart, SearchEnd</query>
          <earliest>-7d@d</earliest>
          <latest>@d</latest>
          <done>
            <set token="Time_Period_Start">$result.SearchStart$</set>
            <set token="Time_Period_End">$result.SearchEnd$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>

 

0 Karma

mahesh27
Communicator

Hi @Thulasinathan_M , i tried your xml and generated PDF the  start and end date are showing as Invalid in PDF report.
And moreover can u take my xml and show me how to add tokens to the panels.
so that i can see start and end date in the report.

Tags (1)
0 Karma

Thulasinathan_M
Contributor

Hi,
Have you tried the one I shared, if yes please share me your updated dashboard xml. It's working for me I could see the time on report.

0 Karma

mahesh27
Communicator

Below is the complete xml.
here i am not getting how to add the token values to the other panels in the dashboard.
Can you help me on that


<dashboard>
<label> Dashboard title</label>
<row>
    <panel>
      <table depends="$hide$">
        <title>$Time_Period_Start$ $Time_Period_End$</title>
        <search>
          <query>| makeresults
| addinfo
| eval SearchStart = strftime(info_min_time, "%Y-%m-%d %H:%M:%S"), SearchEnd = strftime(info_max_time, "%Y-%m-%d %H:%M:%S")
| table SearchStart, SearchEnd</query>
          <earliest>-7d@d</earliest>
          <latest>@d</latest>
          <done>
            <set token="Time_Period_Start">$result.SearchStart$</set>
            <set token="Time_Period_End">$result.SearchEnd$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>
<row>
<panel>
<title>first panel</title>
<single>
<search>
<query>|tstats count as internal_logs where index=_internal
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>second panel</title>
<single>
<search>
<query>|tstats count as audit_logs where index=_audit
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Third panel</title>
<single>
<search>
<query>|tstats count as main_logs where index=main
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>



0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...