Hi @avikc100 You can create a search that calculates the relevant dates which set tokens and then use the tokens: <search id="days">
<query>| makeresults
| eval dayMinus0=strftime(now(), "%...
See more...
Hi @avikc100 You can create a search that calculates the relevant dates which set tokens and then use the tokens: <search id="days">
<query>| makeresults
| eval dayMinus0=strftime(now(), "%d/%m/%Y")
| eval dayMinus1=strftime(now()-86400, "%d/%m/%Y")
| eval dayMinus2=strftime(now()-(86400*2), "%d/%m/%Y")
| eval dayMinus3=strftime(now()-(86400*3), "%d/%m/%Y")
| eval dayMinus4=strftime(now()-(86400*4), "%d/%m/%Y")
| eval dayMinus5=strftime(now()-(86400*5), "%d/%m/%Y")</query>
<done>
<set token="dayMinus0">$result.dayMinus0$</set>
<set token="dayMinus1">$result.dayMinus1$</set>
<set token="dayMinus2">$result.dayMinus2$</set>
<set token="dayMinus3">$result.dayMinus3$</set>
<set token="dayMinus4">$result.dayMinus4$</set>
<set token="dayMinus5">$result.dayMinus5$</set>
</done>
</search> Then use $dayMinusN$ for each Title - where N is the number of days, like this: Below is the full XML example of that dashboard above for you to play with if it helps: <dashboard version="1.1" theme="light">
<label>SplunkAnswers1</label>
<search id="days">
<query>| makeresults
| eval dayMinus0=strftime(now(), "%d/%m/%Y")
| eval dayMinus1=strftime(now()-86400, "%d/%m/%Y")
| eval dayMinus2=strftime(now()-(86400*2), "%d/%m/%Y")
| eval dayMinus3=strftime(now()-(86400*3), "%d/%m/%Y")
| eval dayMinus4=strftime(now()-(86400*4), "%d/%m/%Y")
| eval dayMinus5=strftime(now()-(86400*5), "%d/%m/%Y")</query>
<done>
<set token="dayMinus0">$result.dayMinus0$</set>
<set token="dayMinus1">$result.dayMinus1$</set>
<set token="dayMinus2">$result.dayMinus2$</set>
<set token="dayMinus3">$result.dayMinus3$</set>
<set token="dayMinus4">$result.dayMinus4$</set>
<set token="dayMinus5">$result.dayMinus5$</set>
</done>
</search>
<search id="baseTest">
<query>|tstats count where index=_internal by _time, host span=1d
| eval daysAgo=floor((now()-_time)/86400)</query>
<earliest>-7d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<row>
<panel>
<table>
<title>$dayMinus0$</title>
<search base="baseTest">
<query>| where daysAgo=0 | table host count</query>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<table>
<title>$dayMinus1$</title>
<search base="baseTest">
<query>| where daysAgo=1 | table host count</query>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<table>
<title>$dayMinus2$</title>
<search base="baseTest">
<query>| where daysAgo=2 | table host count</query>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<table>
<title>$dayMinus3$</title>
<search base="baseTest">
<query>| where daysAgo=3 | table host count</query>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<table>
<title>$dayMinus4$</title>
<search base="baseTest">
<query>| where daysAgo=4 | table host count</query>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<table>
<title>$dayMinus5$</title>
<search base="baseTest">
<query>| where daysAgo=5 | table host count</query>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard> Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing