Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Why don't my dynamic titles for month names wo...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why don't my dynamic titles for month names work?
I have tried to pass a token into a panel title from a search that creates month names for last month and the month before that. I have tried using CDATA and just $xxxx$ in the title. Hellllp!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I got it to work but it uses input time. The time will always be -1mon and -2mon. How can I hide that so its not seen?
test
<panel>
<html> <p><center> <b><font size="5">$last_month$ Count</font></b></center></p></html>
</panel>
<panel>
<html> <p><center> <b><font size="5">$twoMonths$ Count</font></b></center></p> </html>
</panel>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No need for a search to do that:
<form>
<init>
<eval token="last_month">strftime(relative_time(time(), "-1mon"), "%b")</eval>
</init>
<row>
<panel>
<title>$last_month$</title>
</panel>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I can post my code but, the code above doesnt work for me either. Odd??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@c0rrinn3,
Which version of Splunk Are you on?
section in Simple XML Dashboard is available from Splunk Enterprise 6.5 onward.
Are you adding token to title from UI Panel Edit or Simple XML code?
If you add from UI Panel Edit then $ sign for token will escape as $$ and it will be treated as string rather than token.
Kindly share you current code which is not working and your Splunk Enteprise version as well.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am on Enterprise 6.4. I have tried a different code also and have combined both in the following example. The example I found with the giraffe works but I cant get it to generate previous month.
TimeTestTakeThree
<input type="text" token="newname">
<label>labelrino</label>
<default>giraffe</default>
<change>
<eval token="Ucase">upper('value')</eval>
<eval token="leno">len('value')</eval>
</change>
<html>
<p>Raw Entry: <b>$newname$</b></p>
<p>Upper(raw):<b>$Ucase$</b></p>
<p>Length(raw): <b>$leno$</b></p>
</html>
<eval token="last_month">strftime(relative_time(time(), "-1mon"), "%b")</eval>
<panel>
<title>$last_month$</title>
</panel>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That example I posted isnt the one I meant to post. the bottom panel should be the one from above.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check out this app:
https://splunkbase.splunk.com/app/1603/
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Post your XML. This is totally doable and you are probably missing something very basic.
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
