topic Re: How to fill empty latest parameter in URL in Splunk Search

How to fill empty latest parameter in URL

mbschriek — Fri, 11 Nov 2016 07:59:33 GMT

When I open a dashboard the URL looks like this:

https://....../en-US/app/app_name/dashboard?earliest=0&latest=

However, when my dashboard reloads after a while, after login, the url looks like this:

https://....../en-US/app/app_name/dashboard?earliest=0

Since the latest= disappeared the dashboard states that the graphs are waiting for input. How can I change this behavior and always set latest=now in my dashboard URL, to prevent it from failing after a reload?

Re: How to fill empty latest parameter in URL

SierraX — Fri, 11 Nov 2016 09:48:54 GMT

Hi,

when I open a dashboard with a default timepicker on yesterday the browser line looks:

?form.field1.earliest=-1d%40d&form.field1.latest=%40d

and if I use all time (like you)

?form.field1.earliest=0&form.field1.latest=

are you sure the now is not deleted because its not necessary?

HTH
Kind Regards
SierraX

Re: How to fill empty latest parameter in URL

SierraX — Fri, 11 Nov 2016 09:52:27 GMT

btw %40 == @

Re: How to fill empty latest parameter in URL

niketn — Fri, 11 Nov 2016 12:53:10 GMT

The following field are added by default which tells dashabord to be run for all time.

**earliest=0&latest=**

However the same will not be applied to your query unless you have used Search string time range scope as tokens/Global

If you want to use Time control to for setting latest time as well set it to now instead of empty. If you dont need the same then set Time Range to Explicit so that it takes whatever timerange you provide to the specific query.
i.e. latest=now

Also running Dashboard for All time would not be a recommended approach so earliest should ideally not be set to 0.

Re: How to fill empty latest parameter in URL

niketn — Fri, 11 Nov 2016 13:45:53 GMT

Empty latest field is same as latest=now or latest=@s. However, while setting All Time in the Time input control from the Presets, the latest value is set as empty which can not be utilized by panels. So, Edit Panel > Edit Time input and if you have to choose Default time as All Time then instead of choosing All Time from Presets, select Advanced drop down and enter Earliest=0 and Latest=now and click Apply.

Both of the following should work
Latest=now or Latest=@s

Re: How to fill empty latest parameter in URL

mbschriek — Mon, 14 Nov 2016 07:05:06 GMT

Thanks for the reply. The time mechanism in Splunk is known by me. I've used tokens in my dashboard for the time pickers, so the ones in the url are not similar. However, the strange thing behavior is that keeping a dashboard open with the first URL, hibernating a laptop, and starting the dashboard again (URL 1 becomes URL 2) shows an "waiting for input" error in my panel.