topic Issue with time selector in Dashboards & Visualizations

Issue with time selector

uagraw01 — Mon, 16 Jun 2025 04:05:29 GMT

Hello Splunkers

The time selector is not visible for a specific user, whereas it is visible for the admin role. Could anyone please suggest which capability needs to be added to the user's role to make the time selector visible on the dashboard?

Time selector is visible for the admin user.

Re: Issue with time selector

isoutamo — Tue, 17 Jun 2025 14:50:28 GMT

Have you added some options to this dashboard which could cause that user cannot see those input fields? And is it only time input or other inputs too?

Re: Issue with time selector

uagraw01 — Wed, 18 Jun 2025 10:40:15 GMT

@isoutamo I am using only time selector in the dashboard and code for the time selector as mentioned below.

<input id="time" type="time" token="time" depends="$operational_start_time$, $operational_end_time$" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>-7d@h</earliest>
<latest>now</latest>
</default>
<change>
<eval token="time.earliest_epoch">if('earliest'="",0,if(isnum('earliest'),'earliest'+($operational_start_time$*3600),relative_time(now(),'earliest')))+($operational_start_time$*3600)</eval>
<eval token="time.latest_epoch">if('earliest'="",0,if(isnum('earliest'),'earliest'+(86400)+($operational_start_time$*3600),relative_time(now(),'earliest')))+(86400)+($operational_start_time$*3600)</eval>
</change>

Re: Issue with time selector

ITWhisperer — Wed, 18 Jun 2025 11:21:35 GMT

You have a depends attribute on this input, perhaps these tokens are not defined for the user?

Re: Issue with time selector

isoutamo — Wed, 18 Jun 2025 11:49:31 GMT

As you have used depends attribute on your input, I'm quite sure that this is not a capability issue, instead of it is undefined token.

The easiest way to debug tokens is use simple_xml_examples app and add this to your dashboard

After this addition, you see all used tokens and their values on bottom of page.

https://splunkbase.splunk.com/app/1603

Helsinki UG presentation how to create and debug SXML dashboards https://data-findings.com/wp-content/uploads/2024/09/HSUG-20240903-Tiia-Ojares.pdf

Re: Issue with time selector

uagraw01 — Thu, 19 Jun 2025 06:12:17 GMT

@ITWhisperer Below is my complete code. So do you any any possibility which is causing an issue ? What Can i fix here so it will work for all the users ?

<form script="common:common.js, common:remove_elements.js, customer_reports:attrchange.js, customer_reports:kpi_dashboard.js" stylesheet="common:vanderlande.css, kpi_dashboard.css, common:project_specific.css" hideEdit="true" version="1.1"> <label>KPI Dashboard</label> <search id="thresholds"> <query>| savedsearch report_kpi_dashboard_thresholds</query> <finalized>  <eval token="availability_min_value">$result.system_dashboard_availability_min_value$-0.0001</eval> <eval token="availability_max_value">$result.system_dashboard_availability_max_value$+0.0001</eval> <set token="availability_max_range_threshold">$result.system_dashboard_availability_max_range_threshold$</set>  <eval token="completeness_min_value">$result.system_dashboard_completeness_min_value$-0.0001</eval> <eval token="completeness_max_value">$result.system_dashboard_completeness_max_value$+0.0001</eval> <set token="completeness_max_range_threshold">$result.system_dashboard_completeness_max_range_threshold$</set>  <eval token="group_coherence_min_value">$result.system_dashboard_group_coherence_min_value$-0.0001</eval> <eval token="group_coherence_max_value">$result.system_dashboard_group_coherence_max_value$+0.0001</eval> <set token="group_coherence_max_range_threshold">$result.system_dashboard_group_coherence_max_range_threshold$</set>  <eval token="lead_time_min_value">$result.system_dashboard_lead_time_min_value$-0.0001</eval> <eval token="lead_time_max_value">$result.system_dashboard_lead_time_max_value$+0.0001</eval> <set token="lead_time_max_range_threshold">$result.system_dashboard_lead_time_max_range_threshold$</set>  <eval token="on-time_min_value">$result.system_dashboard_on-time_min_value$-0.0001</eval> <eval token="on-time_max_value">$result.system_dashboard_on-time_max_value$+0.0001</eval> <set token="on-time_max_range_threshold">$result.system_dashboard_on-time_max_range_threshold$</set>  <eval token="partitioning_min_value">$result.system_dashboard_partitioning_min_value$-0.0001</eval> <eval token="partitioning_max_value">$result.system_dashboard_partitioning_max_value$+0.0001</eval> <set token="partitioning_max_range_threshold">$result.system_dashboard_partitioning_max_range_threshold$</set>  <eval token="productivity_min_value">$result.system_dashboard_productivity_min_value$-0.0001</eval> <eval token="productivity_max_value">$result.system_dashboard_productivity_max_value$+0.0001</eval> <set token="productivity_max_range_threshold">$result.system_dashboard_productivity_max_range_threshold$</set>  <eval token="throughput_min_value">$result.system_dashboard_throughput_min_value$-0.0001</eval> <eval token="throughput_max_value">$result.system_dashboard_throughput_max_value$+0.0001</eval> <set token="throughput_max_range_threshold">$result.system_dashboard_throughput_max_range_threshold$</set>  <eval token="utilization_min_value">$result.system_dashboard_utilization_min_value$-0.0001</eval> <eval token="utilization_max_value">$result.system_dashboard_utilization_max_value$+0.0001</eval> <set token="utilization_max_range_threshold">$result.system_dashboard_utilization_max_range_threshold$</set> </finalized> </search> <search id="operational_hours"> <query>| savedsearch set_operational_hours</query> <finalized> <set token="operational_start_time">$result.operational_start_time$</set> <set token="operational_end_time">$result.operational_end_time$</set> <eval token="time.earliest_epoch">if($form.time.earliest$="",0,if(isnum($form.time.earliest$),$form.time.earliest$,relative_time(now(),$form.time.earliest$)))+($operational_start_time$*3600)</eval> <eval token="time.latest_epoch">if(isnum($form.time.latest$),$form.time.latest$,relative_time(now(),$form.time.latest$))+($operational_start_time$*3600)</eval> </finalized> </search> <fieldset autoRun="true" submitButton="false"> <input id="time" type="time" token="time" depends="$operational_start_time$, $operational_end_time$" searchWhenChanged="true"> <label>Time</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> <change> <eval token="time.earliest_epoch">if('earliest'="",0,if(isnum('earliest'),'earliest'+($operational_start_time$*3600),relative_time(now(),'earliest')))+($operational_start_time$*3600)</eval> <eval token="time.latest_epoch">if('earliest'="",0,if(isnum('earliest'),'earliest'+(86400)+($operational_start_time$*3600),relative_time(now(),'earliest')))+(86400)+($operational_start_time$*3600)</eval> </change> </input> </fieldset> <row> <panel> <title>Throughput</title> <chart id="throughput"> <search> <query>| savedsearch report_kpi_dashboard_throughput operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">radialGauge</option> <option name="charting.chart.rangeValues">[$throughput_min_value$,$throughput_max_range_threshold$,$throughput_max_value$]</option> <option name="charting.chart.showMinorTicks">1</option> <option name="charting.chart.style">minimal</option> <option name="charting.gaugeColors">["0x3FC77A","0xB44441"]</option> <option name="refresh.display">progressbar</option> </chart> <html> <center>Cases</center> </html> </panel> <panel> <title>Availability</title> <chart id="availability"> <search> <query>| savedsearch report_kpi_dashboard_availability operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">radialGauge</option> <option name="charting.chart.rangeValues">[$availability_min_value$,$availability_max_range_threshold$,$availability_max_value$]</option> <option name="charting.chart.showMinorTicks">1</option> <option name="charting.chart.style">minimal</option> <option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option> <option name="refresh.display">progressbar</option> </chart> <html> <center>Percentage</center> </html> </panel> <panel> <title>Completeness</title> <chart id="completeness"> <search> <query>| savedsearch report_kpi_dashboard_completeness operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">radialGauge</option> <option name="charting.chart.rangeValues">[$completeness_min_value$,$completeness_max_range_threshold$,$completeness_max_value$]</option> <option name="charting.chart.showMinorTicks">1</option> <option name="charting.chart.style">minimal</option> <option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option> <option name="refresh.display">progressbar</option> </chart> <html> <center>Percentage</center> </html> </panel> <panel> <title>On-Time</title> <chart id="on_time"> <search> <query>| savedsearch report_kpi_dashboard_on_time operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">radialGauge</option> <option name="charting.chart.rangeValues">[$on-time_min_value$,$on-time_max_range_threshold$,$on-time_max_value$]</option> <option name="charting.chart.showMinorTicks">1</option> <option name="charting.chart.style">minimal</option> <option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option> <option name="refresh.display">progressbar</option> </chart> <html> <center>Percentage</center> </html> </panel> <panel> <title>Lead Time</title> <chart id="lead_time"> <search> <finalized> <eval token="lead_time">now()</eval> </finalized> <query>| savedsearch report_kpi_dashboard_lead_time operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">radialGauge</option> <option name="charting.chart.majorUnit">1800</option> <option name="charting.chart.rangeValues">[$lead_time_min_value$,$lead_time_max_range_threshold$,$lead_time_max_value$]</option> <option name="charting.chart.showMinorTicks">1</option> <option name="charting.chart.style">minimal</option> <option name="charting.gaugeColors">["0x3FC77A","0xB44441"]</option> <option name="refresh.display">progressbar</option> </chart> <html> <center>Duration (hh:mm)</center> </html> </panel> </row> <row> <panel> <title>Utilization</title> <chart id="utilization"> <search> <query>| savedsearch report_kpi_dashboard_lfl_utilisation operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">radialGauge</option> <option name="charting.chart.rangeValues">[$utilization_min_value$,$utilization_max_range_threshold$,$utilization_max_value$]</option> <option name="charting.chart.showMinorTicks">1</option> <option name="charting.chart.style">minimal</option> <option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option> <option name="refresh.display">progressbar</option> </chart> <html> <center>Percentage</center> </html> </panel> <panel> <title>Partitioning</title> <chart id="partitioning"> <search> <query>| savedsearch report_kpi_dashboard_lfl_partitioning operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">radialGauge</option> <option name="charting.chart.rangeValues">[$partitioning_min_value$,$partitioning_max_range_threshold$,$partitioning_max_value$]</option> <option name="charting.chart.showMinorTicks">1</option> <option name="charting.chart.style">minimal</option> <option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option> <option name="refresh.display">progressbar</option> </chart> <html> <center>Percentage</center> </html> </panel> <panel> <title>Group Coherence</title> <chart id="group_coherence"> <search> <query>| savedsearch report_kpi_dashboard_lfl_group_coherence operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">radialGauge</option> <option name="charting.chart.rangeValues">[$group_coherence_min_value$,$group_coherence_max_range_threshold$,$group_coherence_max_value$]</option> <option name="charting.chart.showMinorTicks">1</option> <option name="charting.chart.style">minimal</option> <option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option> <option name="refresh.display">progressbar</option> </chart> <html> <center>Percentage</center> </html> </panel> <panel> <title>Productivity</title> <chart id="productivity"> <search> <query>| savedsearch report_kpi_dashboard_productivity operational_start_time=$operational_start_time$ operational_end_time=$operational_end_time$ earliest_epoch=$time.earliest_epoch$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.chart">radialGauge</option> <option name="charting.chart.rangeValues">[$productivity_min_value$,$productivity_max_range_threshold$,$productivity_max_value$]</option> <option name="charting.chart.showMinorTicks">1</option> <option name="charting.chart.style">minimal</option> <option name="charting.gaugeColors">["0xB44441","0x3FC77A"]</option> <option name="refresh.display">progressbar</option> </chart> <html> <center>Cases/Hour</center> </html> </panel> <panel></panel> </row> </form>

Re: Issue with time selector

uagraw01 — Thu, 19 Jun 2025 06:18:27 GMT

@ITWhisperer So, if I remove the depends attributes, will it start working for the users?

Re: Issue with time selector

ITWhisperer — Thu, 19 Jun 2025 10:08:27 GMT

Check the permissions and visibility of all the saved searches, although particularly set_operational_hours as this seems to set the appropriate tokens. You could also try using done rather than finalized

Re: Issue with time selector

uagraw01 — Thu, 19 Jun 2025 10:38:30 GMT

@ITWhisperer Sure, thanks for the suggestion. Let me check

Re: Issue with time selector

ITWhisperer — Thu, 19 Jun 2025 10:48:54 GMT

Removing the depends will make the time selector input visible, but it still won't work because the change handler uses the operational_start_time token (which as we know is currently available for all users).

Re: Issue with time selector

uagraw01 — Thu, 19 Jun 2025 11:08:37 GMT

Hi @ITWhisperer
I have already used the finalized and done brackets, but the issue still persists. Additionally, I moved the saved search to the search app location to test, but it did not resolve the problem either.

Re: Issue with time selector

isoutamo — Thu, 19 Jun 2025 11:40:53 GMT

I supposing that when you are running this

<search id="operational_hours"> <query>| savedsearch set_operational_hours</query> <finalized> <set token="operational_start_time">$result.operational_start_time$</set>

It used some indexes or other KO which are not allowed for regular users. You should check it users can use that command on GUI and get results.

If I remember correctly there was some restrictions to use at least loadjob in SHC, but I'm not sure if there are same kind of restrictions with savedsearch command? I couldn't find any mentions in docs.

Then you must remember this:

When the savedsearch command runs a saved search, the command always applies the permissions associated with the role of the person running the savedsearch command to the search. The savedsearch command never applies the permissions associated with the role of the person who created and owns the search to the search. This happens even when a saved search has been set up to run as the report owner.

If you need to get this run as an owner instead of running user you must use ref on dashboard for those queries. But even then you cannot add/modify parameters which those searches accept and used. If you try to use those then splunk run those also as user not as owner.

Re: Issue with time selector

ITWhisperer — Thu, 19 Jun 2025 11:59:09 GMT

Try (temporarily) adding a new panel to see what your users are getting back from the saved search and whether there are any errors

<row> <panel> <title>Operational times</title> <table> <search> <query>| savedsearch set_operational_hours</query> <earliest>0</earliest> <latest>now</latest> </search> </table> </panel> </row>

Moving the search may not help if the users' role does not allow them to successfully execute the savedsearch. Please check the permissions (as I said earlier).