I want to replace hard coded text "Today" by current system date in splunk report

[avikc100]

I want to replace hard coded text "Today" by current system date in splunk report. Please help if it is possible.
Please see the attachment.

[yuanliu]

This is confusing: how do you get those "hard coded" text in the first place? In Splunk, the opposite is harder, rendering system date into English word strings.

But if you got those strings in some dataset, you sure can "translate" them back.  Suppose your hard coded input is called hardcoded, this search will turn the string into systemdate:

| eval decrement = case(
  hardcoded == "Today", 0,
  hardcoded == "Yesterday", 1,
  true(), replace(hardcoded, "Last (\d+).+", "\1")
  )
| eval systemdate = strftime(relative_time(now(), "-" . decrement . "day"), "%F")

decrement	hardcoded	systemdate
0	Today	2025-04-24
1	Yesterday	2025-04-23
2	Last 2nd Day	2025-04-22
3	Last 3rd Day	2025-04-21
4	Last 4th Day	2025-04-20
5	Last 5th Day	2025-04-19

Here is a full emulation for you to play with and compare with real data.

| makeresults format=csv data="hardcoded
Today
Yesterday
Last 2nd Day
Last 3rd Day
Last 4th Day
Last 5th Day"
| eval decrement = case(
  hardcoded == "Today", 0,
  hardcoded == "Yesterday", 1,
  true(), replace(hardcoded, "Last (\d+).+", "\1")
  )
| eval systemdate = strftime(relative_time(now(), "-" . decrement . "day"), "%F")

[avikc100]

sorry for confusion!

i want system date here in this test area in the dashboard.

[yuanliu]

Then, where does the dashboard get those strings? In other words, what is the code in that dashboard that prints those strings?

[livehybrid]

Hi @avikc100 

Were you able to try my previous example (see below)? If there is an issue with this i'd be happy to try and resolve for you.

Thanks

---

@livehybrid wrote:

Hi @avikc100 

You can create a search that calculates the relevant dates which set tokens and then use the tokens:

  <search id="days">
    <query>| makeresults 
| eval dayMinus0=strftime(now(), "%d/%m/%Y") 
| eval dayMinus1=strftime(now()-86400, "%d/%m/%Y") 
| eval dayMinus2=strftime(now()-(86400*2), "%d/%m/%Y") 
| eval dayMinus3=strftime(now()-(86400*3), "%d/%m/%Y") 
| eval dayMinus4=strftime(now()-(86400*4), "%d/%m/%Y") 
| eval dayMinus5=strftime(now()-(86400*5), "%d/%m/%Y")</query>
    <done>
      <set token="dayMinus0">$result.dayMinus0$</set>
      <set token="dayMinus1">$result.dayMinus1$</set>
      <set token="dayMinus2">$result.dayMinus2$</set>
      <set token="dayMinus3">$result.dayMinus3$</set>
      <set token="dayMinus4">$result.dayMinus4$</set>
      <set token="dayMinus5">$result.dayMinus5$</set>
    </done>
  </search>

Then use $dayMinusN$ for each Title - where N is the number of days, like this:

Below is the full XML example of that dashboard above for you to play with if it helps:

<dashboard version="1.1" theme="light">
  <label>SplunkAnswers1</label>
  <search id="days">
    <query>| makeresults 
| eval dayMinus0=strftime(now(), "%d/%m/%Y") 
| eval dayMinus1=strftime(now()-86400, "%d/%m/%Y") 
| eval dayMinus2=strftime(now()-(86400*2), "%d/%m/%Y") 
| eval dayMinus3=strftime(now()-(86400*3), "%d/%m/%Y") 
| eval dayMinus4=strftime(now()-(86400*4), "%d/%m/%Y") 
| eval dayMinus5=strftime(now()-(86400*5), "%d/%m/%Y")</query>
    <done>
      <set token="dayMinus0">$result.dayMinus0$</set>
      <set token="dayMinus1">$result.dayMinus1$</set>
      <set token="dayMinus2">$result.dayMinus2$</set>
      <set token="dayMinus3">$result.dayMinus3$</set>
      <set token="dayMinus4">$result.dayMinus4$</set>
      <set token="dayMinus5">$result.dayMinus5$</set>
    </done>
  </search>
  <search id="baseTest">
    <query>|tstats count where index=_internal by _time, host span=1d 
| eval daysAgo=floor((now()-_time)/86400)</query>
    <earliest>-7d@d</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <row>
    <panel>
      <table>
        <title>$dayMinus0$</title>
        <search base="baseTest">
          <query>| where daysAgo=0 | table host count</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>$dayMinus1$</title>
        <search base="baseTest">
          <query>| where daysAgo=1 | table host count</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>$dayMinus2$</title>
        <search base="baseTest">
          <query>| where daysAgo=2 | table host count</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>$dayMinus3$</title>
        <search base="baseTest">
          <query>| where daysAgo=3 | table host count</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>$dayMinus4$</title>
        <search base="baseTest">
          <query>| where daysAgo=4 | table host count</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>$dayMinus5$</title>
        <search base="baseTest">
          <query>| where daysAgo=5 | table host count</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

---

[ITWhisperer]

Please provide the source code for your dashboard in a code block using the </> button to insert the text.

[livehybrid]

Hi @avikc100 

You can create a search that calculates the relevant dates which set tokens and then use the tokens:

  <search id="days">
    <query>| makeresults 
| eval dayMinus0=strftime(now(), "%d/%m/%Y") 
| eval dayMinus1=strftime(now()-86400, "%d/%m/%Y") 
| eval dayMinus2=strftime(now()-(86400*2), "%d/%m/%Y") 
| eval dayMinus3=strftime(now()-(86400*3), "%d/%m/%Y") 
| eval dayMinus4=strftime(now()-(86400*4), "%d/%m/%Y") 
| eval dayMinus5=strftime(now()-(86400*5), "%d/%m/%Y")</query>
    <done>
      <set token="dayMinus0">$result.dayMinus0$</set>
      <set token="dayMinus1">$result.dayMinus1$</set>
      <set token="dayMinus2">$result.dayMinus2$</set>
      <set token="dayMinus3">$result.dayMinus3$</set>
      <set token="dayMinus4">$result.dayMinus4$</set>
      <set token="dayMinus5">$result.dayMinus5$</set>
    </done>
  </search>

Then use $dayMinusN$ for each Title - where N is the number of days, like this:

Below is the full XML example of that dashboard above for you to play with if it helps:

<dashboard version="1.1" theme="light">
  <label>SplunkAnswers1</label>
  <search id="days">
    <query>| makeresults 
| eval dayMinus0=strftime(now(), "%d/%m/%Y") 
| eval dayMinus1=strftime(now()-86400, "%d/%m/%Y") 
| eval dayMinus2=strftime(now()-(86400*2), "%d/%m/%Y") 
| eval dayMinus3=strftime(now()-(86400*3), "%d/%m/%Y") 
| eval dayMinus4=strftime(now()-(86400*4), "%d/%m/%Y") 
| eval dayMinus5=strftime(now()-(86400*5), "%d/%m/%Y")</query>
    <done>
      <set token="dayMinus0">$result.dayMinus0$</set>
      <set token="dayMinus1">$result.dayMinus1$</set>
      <set token="dayMinus2">$result.dayMinus2$</set>
      <set token="dayMinus3">$result.dayMinus3$</set>
      <set token="dayMinus4">$result.dayMinus4$</set>
      <set token="dayMinus5">$result.dayMinus5$</set>
    </done>
  </search>
  <search id="baseTest">
    <query>|tstats count where index=_internal by _time, host span=1d 
| eval daysAgo=floor((now()-_time)/86400)</query>
    <earliest>-7d@d</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <row>
    <panel>
      <table>
        <title>$dayMinus0$</title>
        <search base="baseTest">
          <query>| where daysAgo=0 | table host count</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>$dayMinus1$</title>
        <search base="baseTest">
          <query>| where daysAgo=1 | table host count</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>$dayMinus2$</title>
        <search base="baseTest">
          <query>| where daysAgo=2 | table host count</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>$dayMinus3$</title>
        <search base="baseTest">
          <query>| where daysAgo=3 | table host count</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>$dayMinus4$</title>
        <search base="baseTest">
          <query>| where daysAgo=4 | table host count</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>$dayMinus5$</title>
        <search base="baseTest">
          <query>| where daysAgo=5 | table host count</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing