topic Dashboard Input Error When Time Is Set As "All Time" in Dashboards & Visualizations

Dashboard Input Error When Time Is Set As "All Time"

LuiesCui — Thu, 05 Mar 2015 05:50:47 GMT

hey guys, i'm new to splunk and i really need ur help!!!
i built a form with an input

<input type="time" token="time1" searchWhenChanged="true">
  <label>Time</label>
  <default>
    <earliestTime>-24h@d</earliestTime>
    <latestTime>@d</latestTime>
  </default>
</input>

and my search string is

<query>
    index=ha  "ha_fids: Terminating CM"  earliest=$time1.earliest$ latest=$time1.latest$ 
    | eval time=_time  
    | stats count by time 
    | SORT -time 
    | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(time)
    | rename time as WarningTime 
    | table WarningTime 
</query>

everything works fine except an error occurs when i choose "all time" on the input bar :

"Error in 'search' command: unable to parse the search: Comparator '=' is missing a term on the right hand side."

my guess was when i choose "all time", earliest=$time1.earliest$, which is null. so i tried with double quotes around the tokens.

earliest="$time1.earliest$" latest="$time1.latest$"

no errors occur and no results are found. so how do i correct my search string?

Re: Dashboard Input Error When Time Is Set As "All Time"

markthompson — Thu, 05 Mar 2015 09:17:06 GMT

Your problem here is that "All time" doesn't use an earliest or latest time, it simply searches through everything. Which is probably whats causing your error, Why are you using earliest and latest time in your searches? Surely you should use a timepicker in your dashboard and use those values as your search string.

Re: Dashboard Input Error When Time Is Set As "All Time"

stephane_cyrill — Thu, 05 Mar 2015 10:11:43 GMT

Hi Luies,

I see that you are using splunk 6.2 if it is the case we change earliestTime and latestTime into earliest and latest in your input setting

Try to to use the time range like this:enter code here

<search>
 <query>
     index=ha  "ha_fids: Terminating CM"  
     | eval time=_time  
     | stats count by time 
     | SORT -time 
     | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(time)
     | rename time as WarningTime 
     | table WarningTime 
 </query>
<earliest>$time1.earliest$</earliest>
<latest>$time1.latest$</latest>
</search>

Re: Dashboard Input Error When Time Is Set As "All Time"

thirumalreddyb — Mon, 16 May 2016 17:37:26 GMT

What if those tokens should work on a sub-search?