topic Re: Time comparison different results in search and dashboar in Splunk Search

Time comparison different results in search and dashboar

Ste — Tue, 17 Dec 2024 13:51:08 GMT

Dear experts

Why is the following line

| where my_time>=relative_time(now(),"-1d@d") AND my_time<=relative_time(now(),"@d")

Accepted as a valid statement in a search window, but as soon I want to use exactly this code in a dashboard, I get the error message: "Error in line 100: Unencoded <" ?

The dashboard code validator somehow fails with the <= comparison.

>= works, as well = but not <=

We're on splunkcloud.

Re: Time comparison different results in search and dashboar

gcusello — Tue, 17 Dec 2024 13:53:11 GMT

Hi @Ste ,

in dashboards, you cannot use <> and you have to replace them with < and >

| where my_time&gr;=relative_time(now(),"-1d@d") AND my_time<=relative_time(now(),"@d")

Ciao.

giuseppe

Re: Time comparison different results in search and dashboar

Ste — Tue, 17 Dec 2024 14:00:52 GMT

Using the html tags from your proposal would lead into the error message "Error in Line 100: Invalid character entity"

Re: Time comparison different results in search and dashboar

gcusello — Tue, 17 Dec 2024 15:33:34 GMT

Hi @Ste ,

Please share the code of your dashboard with the error using the "Insert/Edit Code Cample" button.

Ciao.

Giuseppe

Re: Time comparison different results in search and dashboar

luizlimapg — Tue, 17 Dec 2024 18:27:17 GMT

Hi @Ste, how are you?

Is > for >
Your SPL is using &gr; instead.

| where my_time>=relative_time(now(),"-1d@d") AND my_time<=relative_time(now(),"@d")

Re: Time comparison different results in search and dashboar

yuanliu — Tue, 17 Dec 2024 22:30:07 GMT

@luizlimapg is correct. If you copy and paste your search into Simple XML code window (or Dashboard Studio code window for that matter), some special characters will be interpreted by the XML engine (or the JSON engine). If you need to do that, use HTML entities to represent these special characters.

It is best to avoid this, however. If you have a panel, copy and paste your search code into the Search popup. (Similarly in the search box under Input.)

Re: Time comparison different results in search and dashboar

Ste — Mon, 23 Dec 2024 11:54:09 GMT

Gentlemen you're right

Search code:

| where my_time>=relative_time(now(),"-1d@d") AND _time<=relative_time(now(),"@d")

updated to

| where my_time >=relative_time(now(),"-1d@d") AND _time <=relative_time(now(),"@d")

will work in a dashboard.

I started from scratch with all my trials and were not able to reproduce my issues with the html tags.

This must be a classic PIBCAK (Problem Is Between Chair and Keyboard)