topic Invalid Earliest_time in Splunk dashboard in Splunk Search

Invalid Earliest_time in Splunk dashboard

shaileshv02 — Tue, 05 Aug 2014 06:55:28 GMT

I am trying to make a dashboard with a custom time by editing the XML and giving the time in tag. I have tried all possible time formats as given in the document but everytime i am getting an error "Invalid earliest_time".
I have given the sample of the xml below.

Performance

Search String
Dashboard Title
5/11/2013:20:00:00
12/11/2013:20:00:00

Any help is appreciated.

Thanks in Advance.

Re: Invalid Earliest_time in Splunk dashboard

strive — Tue, 05 Aug 2014 10:28:59 GMT

In XML You can specify the time as relative time or absolute time. For absolute time it should be in epoch format.

Check this link. http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/PanelreferenceforSimplifiedXML#earliestTime

For relative time modifiers check section Specify relative time ranges in your search in http://docs.splunk.com/Documentation/Splunk/6.1.2/Search/Specifytimemodifiersinyoursearch

Re: Invalid Earliest_time in Splunk dashboard

sklass — Thu, 14 May 2015 19:48:52 GMT

In poking through the returned data - when it did work it looks like the format should be.

YYYY-MM-DDTHH:MM:SS

Example: 2015-05-02T07:30:00

You can also append your timezone at the end as well. Really this is way harder than it should be.