Welcome to WuJiGu Developer Q&A Community for programmer and developer-Open, Learning and Share
Welcome To Ask or Share your Answers For Others

Categories

0 votes
335 views
in Technique[技术] by (71.8m points)

splunk dashboard to include the time rage that will populate into the pdf file

I have a splunk dashboard that returns results based on a time picker with a start and end time frame I would like to have that time range in the dashboard so that the PDF generated it shows the time frame.


与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Answer

0 votes
by (71.8m points)

You can add a <panel> with <html> that displays the $date.earliest$ and $date.latest$ values:

<row>
  <panel>
    <html>
     <h1>Date Range : $date.earliest$ - $date.latest$ </h1>
   </html>
  </panel>
</row>

You may want to format the values to reflect the actual dateTime values. You can evaluate fields with formatted dateTime values:

<input type="time" token="date" searchWhenChanged="true">
  <label>date</label>
  <default>
    <earliest>-40m@m</earliest>
    <latest>now</latest>
  </default>
  <change>
    <eval token="timelabel_earliest">if(isnum($date.earliest$), strftime($date.earliest$,"%m/%d/%Y %H:%M"), strftime(relative_time(now(), $date.earliest$),"%m/%d/%Y %H:%M") )</eval>
    <eval token="timelabel_latest">if(isnum($date.latest$), strftime($date.latest$,"%m/%d/%Y %H:%M"), strftime(relative_time(now(), $date.latest$), "%m/%d/%Y %H:%M") )</eval>
  </change>
</input>

And then use the fields with the formatted values:

<row>
  <panel>
    <html>
      <h1>$AppEnv$ : $timelabel_earliest$ - $timelabel_latest$ </h1>
    </html>
  </panel>
</row>

Below is a complete example of a dashboard demonstrating how to display both the time picker value and formatted:

<form>
  <label>Display Time Picker</label>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
       <change>
         <eval token="timelabel_earliest">if(isnum($field1.earliest$), strftime($field1.earliest$,"%m/%d/%Y %H:%M"), strftime(relative_time(now(), $field1.earliest$),"%m/%d/%Y %H:%M") )</eval>
         <eval token="timelabel_latest">if(isnum($field1.latest$), strftime($field1.latest$,"%m/%d/%Y %H:%M"), strftime(relative_time(now(), $field1.latest$), "%m/%d/%Y %H:%M") )</eval>
      </change>
    </input>
  </fieldset>
  <row>
  <panel>
    <html>
     <h1>Date Range: $field1.earliest$ - $field1.latest$ </h1>
     <h1>Date Range formatted: $timelabel_earliest$ - $timelabel_latest$ </h1>
   </html>
  </panel>
</row>
</form>

Which renders like this: Example dateTime labels


与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome to WuJiGu Developer Q&A Community for programmer and developer-Open, Learning and Share
...