topic Re: How to display a time range token in Splunk Search

How to display a time range token

Jamietriplet — Tue, 03 Dec 2024 12:50:15 GMT

Hello guys, I am trying to add a time range to my search, so the user can pick any time range and see data for the selected time (e.g. 24hours, last 30 days, previous year etc), . I created a time range control and token for this purpose, called TimeRange. But when I run my query, I get the below error:

Invalid value "$TimeRange$" for time term 'earliest'

Here is my query:
base query earliest = $TimeRange$, latest=now ()
| other query

Re: How to display a time range token

ITWhisperer — Tue, 03 Dec 2024 13:01:57 GMT

Please show what is in your token and how you have set it

Re: How to display a time range token

Jamietriplet — Tue, 03 Dec 2024 13:08:37 GMT

Token was set using the time range control. see below image

Re: How to display a time range token

ITWhisperer — Tue, 03 Dec 2024 13:50:12 GMT

Try something like this

earliest = $TimeRange.earliest$, latest=$TimeRange.latest$

Re: How to display a time range token

Jamietriplet — Tue, 03 Dec 2024 13:57:19 GMT

Hello @ITWhisperer , I tried this and got this same error:
Invalid value "$TimeRange.earliest$" for time term 'earliest

Re: How to display a time range token

dural_yyz — Tue, 03 Dec 2024 14:37:26 GMT

Please share the source code for the Time Selection dropdown and for the search panel you are referencing the token.

Re: How to display a time range token

Jamietriplet — Tue, 03 Dec 2024 14:44:38 GMT

hello @dural_yyz ,

This is the source code for the control and token

{

"options": {

"defaultValue": "-24h@h,now",

"token": "TimeRange"

"title": "Time Selection",

"type": "input.timerange"

}

see the picture for the panel

Re: How to display a time range token

dural_yyz — Tue, 03 Dec 2024 14:48:08 GMT

Share the panel that is referencing the TimeRange with the error.

Re: How to display a time range token

Jamietriplet — Tue, 03 Dec 2024 14:54:21 GMT

Do you mean the control panel?

Re: How to display a time range token

dural_yyz — Tue, 03 Dec 2024 15:53:24 GMT

There is a search panel you are trying to pass the variables to. The panel that gives an error when trying to use the token values.

Re: How to display a time range token

ITWhisperer — Tue, 03 Dec 2024 15:55:09 GMT

Your panel will have a search (data source) associated with it - how is that data source configured (with respect to timeframe)?

Re: How to display a time range token

Jamietriplet — Tue, 03 Dec 2024 16:04:05 GMT

index=Index name sourcetype=sourcetype name (field names)earliest=$TimeRange$ latest=now()

Re: How to display a time range token

Jamietriplet — Tue, 03 Dec 2024 16:05:54 GMT

index=Index name sourcetype=sourcetype name (field names)earliest=$TimeRange$ latest=now()

Re: How to display a time range token

dural_yyz — Tue, 03 Dec 2024 16:07:26 GMT

@Jamietriplet wrote:
index=Index name sourcetype=sourcetype name (field names)earliest=$TimeRange$ latest=now()

index=Index name sourcetype=sourcetype name (field names)earliest=$TimeRange.earliest$ latest=$TimeRange.latest$

Re: How to display a time range token

Jamietriplet — Tue, 03 Dec 2024 16:09:47 GMT

Tried this already and got this error:

Invalid value "$TimeRange.earliest$" for time term 'earliest'

Re: How to display a time range token

Jamietriplet — Tue, 03 Dec 2024 16:20:02 GMT

Its important to note that i wrote a similar line of code for another panel and got no error, see below:

index = index name sourcetype = sourcetype name (field names) earliest =$StartTime$ latest=$FinishTime$

Re: How to display a time range token

Jamietriplet — Tue, 03 Dec 2024 20:00:13 GMT

Its important to note that i wrote a similar line of code for another panel and got no error, see below:

index = index name sourcetype = sourcetype name (field names) earliest =$StartTime$ latest=$FinishTime$

Re: How to display a time range token

ITWhisperer — Tue, 03 Dec 2024 16:29:54 GMT

I am not sure why you won't show us what you do have - perhaps we might be able to see what is wrong - what you are sharing with us at the moment is not moving things forward.