topic Why would a time filter working in search but not in the dashboard? in Splunk Search

Why would a time filter working in search but not in the dashboard?

cromm — Mon, 06 Aug 2018 20:36:44 GMT

I built a dashboard and am trying to include a time filter on Purchase Date and not the default _time field. At first I tried removing the _time field and renaming PurDate as _time but that did not work.

Then I added the following bit of code and I was able to filter results in search but it does not work in the dashboard.
Why won't my dashboard update when I change the time filter but does change in search?

Here is the source code for one of the pannels
`
Customer Purchase

-24h@h
now

<panel>
  <title>License Status</title>
  <chart>
    <search>
      <query>| from inputlookup:"customer.csv" 
                         | where (Region="NW") AND (IsActive="True")
                         | eval productName=split("Train##Car##Truck##Bike##Scooter","##") 
                               | mvexpand productName
                         | lookup Purchases.csv customerID productName OUTPUT PurDate
                         | eval PurDate=strptime(FirstPurDate,"%Y-%m-%d")
                         | search 
                             [| makeresults 
                             | addinfo 
                             | eval info_max_time=if(info_max_time=="+Infinity", now(), info_max_time) 
                             | eval foo="FirstPurDate>=".info_min_time." AND PurDate<".info_max_time 
                             | table foo 
                             | rename foo as search]`

Re: Why would a time filter working in search but not in the dashboard?

somesoni2 — Mon, 06 Aug 2018 21:08:26 GMT

What was the time range used when you ran this in search page?

Re: Why would a time filter working in search but not in the dashboard?

cromm — Mon, 06 Aug 2018 21:30:54 GMT

I tried a few different options like date ranges (ex. 05/01/2018 through today) and presets (ex. current fiscal year). they all worked in the search but the dashboard would not change from what I last did in the search

Re: Why would a time filter working in search but not in the dashboard?

poete — Tue, 07 Aug 2018 13:59:17 GMT

Hello @cromm,

I think you should try using < and > instead if < and > in your panel code.
Can you please try this?

Re: Why would a time filter working in search but not in the dashboard?

DalJeanis — Tue, 07 Aug 2018 14:18:07 GMT

1) As @poete suggested, you need to use > and < in the panel code for > and <.

2) Do not assign a value to info_max_time - that field is set at the search level. Use another variable name.

3) Make sure that your underlying variables (FirstPurDate) are stored in epoch format.