Splunk Search

How to show custom time for PDF schedule report?

mahesh27
Communicator

Dashboard xml:
I am using this dashboard  to Schedule PDF report, and all panels are showing data for 7 days.
I need to show the time period at the top  of the report like
Time Period: 01-17-2023 to 01-23-2023
how can i do this??

 

 

<dashboard>
<label> Dashboard title</label>
<row>
<panel>
<title>first panel</title>
<single>
<search>
<query>|tstats count as internal_logs where index=_internal
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>second panel</title>
<single>
<search>
<query>|tstats count as audit_logs where index=_audit
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Third panel</title>
<single>
<search>
<query>|tstats count as main_logs where index=main
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>

 

 

 

Labels (1)
Tags (1)
0 Karma

mahesh27
Communicator

Can anyone help on this??

Tags (1)
0 Karma

Thulasinathan_M
Contributor

Hi,
Try something like this, hope it works. You can hide the table and use the token on your panel title.

<row>
    <panel>
      <table depends="$hide$">
        <title>$Time_Period_Start$ $Time_Period_End$</title>
        <search>
          <query>| makeresults
| addinfo
| eval SearchStart = strftime(info_min_time, "%Y-%m-%d %H:%M:%S"), SearchEnd = strftime(info_max_time, "%Y-%m-%d %H:%M:%S")
| table SearchStart, SearchEnd</query>
          <earliest>-7d@d</earliest>
          <latest>@d</latest>
          <done>
            <set token="Time_Period_Start">$result.SearchStart$</set>
            <set token="Time_Period_End">$result.SearchEnd$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>

 

0 Karma

mahesh27
Communicator

Hi @Thulasinathan_M , i tried your xml and generated PDF the  start and end date are showing as Invalid in PDF report.
And moreover can u take my xml and show me how to add tokens to the panels.
so that i can see start and end date in the report.

Tags (1)
0 Karma

Thulasinathan_M
Contributor

Hi,
Have you tried the one I shared, if yes please share me your updated dashboard xml. It's working for me I could see the time on report.

0 Karma

mahesh27
Communicator

Below is the complete xml.
here i am not getting how to add the token values to the other panels in the dashboard.
Can you help me on that


<dashboard>
<label> Dashboard title</label>
<row>
    <panel>
      <table depends="$hide$">
        <title>$Time_Period_Start$ $Time_Period_End$</title>
        <search>
          <query>| makeresults
| addinfo
| eval SearchStart = strftime(info_min_time, "%Y-%m-%d %H:%M:%S"), SearchEnd = strftime(info_max_time, "%Y-%m-%d %H:%M:%S")
| table SearchStart, SearchEnd</query>
          <earliest>-7d@d</earliest>
          <latest>@d</latest>
          <done>
            <set token="Time_Period_Start">$result.SearchStart$</set>
            <set token="Time_Period_End">$result.SearchEnd$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>
<row>
<panel>
<title>first panel</title>
<single>
<search>
<query>|tstats count as internal_logs where index=_internal
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>second panel</title>
<single>
<search>
<query>|tstats count as audit_logs where index=_audit
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Third panel</title>
<single>
<search>
<query>|tstats count as main_logs where index=main
</query>
<earliest>-7d@d</earliest>
<latest>@d</latest>
<sampleRatio>1<sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</dashboard>



0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...