Splunk Search

how to show date in splunk dashboard panel title or label

surekhasplunk
Communicator

Hi,

How to show the last indexed file's date in the panel title or label in splunk dashboard.
the input lookup file i am using in my queries looks like abc_ddmmyyyy.csv
I am doing some calculations on this lookup file and populating the dashboard panel.
Now i want to somehow show the date from the filename which should get dynamically populated .

Thanks

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

You can use the solution from below post (basically adding a <search> element which will run a search and set timelabel token which will be used in the dashboard label.

https://answers.splunk.com/answers/590196/dashboard-title-display-date-as-ddmmyyyy.html

Your search element can be this

<search>
     <query>|tstats latest(source) as source WHERE index=yourIndex sourcetype=yourSourcetype | eval source=replace(source,".+_(\d{8}\.csv","\1") </query>
     <earliest>$field1.earliest$</earliest>
     <latest>$field1.latest$</latest>
           <progress>
             <eval token="timelabel">$result.source$</eval>
           </progress>
   </search>

View solution in original post

0 Karma

somesoni2
Revered Legend

You can use the solution from below post (basically adding a <search> element which will run a search and set timelabel token which will be used in the dashboard label.

https://answers.splunk.com/answers/590196/dashboard-title-display-date-as-ddmmyyyy.html

Your search element can be this

<search>
     <query>|tstats latest(source) as source WHERE index=yourIndex sourcetype=yourSourcetype | eval source=replace(source,".+_(\d{8}\.csv","\1") </query>
     <earliest>$field1.earliest$</earliest>
     <latest>$field1.latest$</latest>
           <progress>
             <eval token="timelabel">$result.source$</eval>
           </progress>
   </search>

View solution in original post

0 Karma

surekhasplunk
Communicator

Instead of eval token when i changed that line to set token it worked.

$result.source$

thanks @Somesoni2

0 Karma

surekhasplunk
Communicator

Hi @somesoni2

I tried implementinig this but the token is not giving me the desired result.

Also could you please tell me whats the significance of field1.earliest whats field1 here ?

0 Karma

somesoni2
Revered Legend

Ohh.. I picked the code from the post and tried to update it to fit your requirement, but missed updating that. That will be either your dashboard's time range picker OR you can specify a custom explicit time range.

0 Karma

niketnilay
Legend

@surekhasplunk are you uploading the csv file as a lookup file or indexing the csv file?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

surekhasplunk
Communicator

Hi @niketnilay,

Yes am indexing the files.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!