topic Time range picker: latest time is always "now in Dashboards & Visualizations

Time range picker: latest time is always "now

goran_epl — Wed, 01 Aug 2018 19:38:24 GMT

Ï have dashboard with time range picker. When I try to select Date Range or Data and Time Range, I cannot select the latest date. It is always "now".
How can I configure this?

Re: Time range picker: latest time is always "now

DalJeanis — Thu, 02 Aug 2018 04:55:58 GMT

Please post the xml code for the time picker. Make sure to mark it as code, for instance with the '101 010' button, so that the interface doesn't treat it as HTML and delete it.

Re: Time range picker: latest time is always "now

goran_epl — Thu, 02 Aug 2018 05:04:51 GMT

This is the XML code:

<input type="time" token="field1" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-7d@h</earliest>
      </default>
    </input>

Re: Time range picker: latest time is always "now

niketn — Tue, 29 Sep 2020 20:46:47 GMT

[Updated Answers] Adding further details as Between should be selected instead of Since.

@goran_epl as stated in my answer before, in the Date & Time Range towards left there is an option to change between Between, Before and Since. In your case you have Since selected when actually it should be Between. Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Aboutthetimerangepicker#Specify_date_and_time_ranges

@goran_epl if you have selected Date Time range appropriately it should work as expected i.e.
1) with between condition and
2) used $field.earliest$ and $field.latest$ in the <earliest> and <latest> attributes for <search>.

Please try the following run anywhere search which uses addinfo command to get the earliest and latest time selected for the search. (PS: Screenshot from Splunk 7.1.1)

Following is the Simple XML code for run anywhere dashboard:

<form>
  <label>Timerange picker Date Range and Date Time Range</label>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| addinfo
| fieldformat info_min_time=strftime(info_min_time,"%Y-%m-%d %H:%M:%S")
| fieldformat info_max_time=strftime(info_max_time,"%Y-%m-%d %H:%M:%S")
| fieldformat info_search_time=strftime(info_search_time,"%Y-%m-%d %H:%M:%S")
| table info_sid _time info_search_time info_min_time info_max_time</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Re: Time range picker: latest time is always "now

goran_epl — Thu, 02 Aug 2018 17:40:25 GMT

I don't think that the code is the problem. I don't have a field to select latest time! See screenshot of your code.

Re: Time range picker: latest time is always "now

niketn — Sat, 04 Aug 2018 14:56:21 GMT

@goran_epl I have updated my answer. Your screenshot shows Date & Time Range option as Since. It should be Between as stated in my answer.