All Apps and Add-ons

Click on the panel value link to search page result in "Invalid earliest_time"

ee07b291
Explorer

I have testing dashboard like below, where user can specify the search time range,

 

 

 

 

  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <label>Select display time range</label>
      <default>
        <earliest>-5d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>

...
...
...

    <panel>
      <title>Test Table</title>
      <event>
        <search>
          <query>eventtype="test_eventtype"
            | fields testColumnA, testColumnB, testColumnC
            | table testColumnA, testColumnB, testColumnC, eventtype
            | sort </query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
          <refresh>30m</refresh>
          <refreshType>delay</refreshType>
        </search>
        <fields>testColumnA, testColumnB, testColumnC</fields>
        <option name="count">10</option>
        <option name="rowNumbers">1</option>
        <option name="type">table</option>
      </event>
    </panel>

 

 

 

 

 

the panel display and time range selection work as expected.  But whenever i click on the column value link in the panel to jump to search page, it fails with the "Invalid earliest_time.".

For the URL:

https://test/en-US/search?q=eventtype%3D%22test_eventtype%22%......&earliest=%24earliest%24&latest=%...

Which indicates the earliest and latest time is not using the actual values but '$earliest$', '$latest$'.

 

So, what is the right way make this working?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...