Splunk Search

Why don't my dynamic titles for month names work?

c0rrinn3
New Member

I have tried to pass a token into a panel title from a search that creates month names for last month and the month before that. I have tried using CDATA and just $xxxx$ in the title. Hellllp!

Tags (1)
0 Karma

c0rrinn3
New Member

I got it to work but it uses input time. The time will always be -1mon and -2mon. How can I hide that so its not seen?

test




strftime(relative_time(time(), "-1mon"), "%B %Y")
strftime(relative_time(time(), "-2mon"), "%B %Y")


<panel>
   <html> <p><center> <b><font size="5">$last_month$ Count</font></b></center></p></html>
</panel>
<panel>
  <html>   <p><center> <b><font size="5">$twoMonths$ Count</font></b></center></p> </html>
</panel>
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

No need for a search to do that:

<form>
  <init>
    <eval token="last_month">strftime(relative_time(time(), "-1mon"), "%b")</eval>
  </init>
  <row>
    <panel>
      <title>$last_month$</title>
    </panel>
  </row>
</form>

c0rrinn3
New Member

I can post my code but, the code above doesnt work for me either. Odd??

0 Karma

niketn
Legend

@c0rrinn3,

Which version of Splunk Are you on?
section in Simple XML Dashboard is available from Splunk Enterprise 6.5 onward.

Are you adding token to title from UI Panel Edit or Simple XML code?
If you add from UI Panel Edit then $ sign for token will escape as $$ and it will be treated as string rather than token.

Kindly share you current code which is not working and your Splunk Enteprise version as well.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

c0rrinn3
New Member

I am on Enterprise 6.4. I have tried a different code also and have combined both in the following example. The example I found with the giraffe works but I cant get it to generate previous month.

TimeTestTakeThree

 <input type="text" token="newname">       
   <label>labelrino</label>
   <default>giraffe</default>       
   <change>         
     <eval token="Ucase">upper('value')</eval>
   <eval token="leno">len('value')</eval>
   </change>



 <html>
   <p>Raw Entry: <b>$newname$</b></p>
   <p>Upper(raw):<b>$Ucase$</b></p>
  <p>Length(raw): <b>$leno$</b></p>
</html>



 <eval token="last_month">strftime(relative_time(time(), "-1mon"), "%b")</eval>


 <panel>
   <title>$last_month$</title>
 </panel>
0 Karma

c0rrinn3
New Member

That example I posted isnt the one I meant to post. the bottom panel should be the one from above.

0 Karma

woodcock
Esteemed Legend
0 Karma

woodcock
Esteemed Legend

Post your XML. This is totally doable and you are probably missing something very basic.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...