Dashboard Input Error When Time Is Set As "All Time"

[LuiesCui]

hey guys, i'm new to splunk and i really need ur help!!!
i built a form with an input

<input type="time" token="time1" searchWhenChanged="true">
  <label>Time</label>
  <default>
    <earliestTime>-24h@d</earliestTime>
    <latestTime>@d</latestTime>
  </default>
</input>

and my search string is

<query>
    index=ha  "ha_fids: Terminating CM"  earliest=$time1.earliest$ latest=$time1.latest$ 
    | eval time=_time  
    | stats count by time 
    | SORT -time 
    | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(time)
    | rename time as WarningTime 
    | table WarningTime 
</query>

everything works fine except an error occurs when i choose "all time" on the input bar :

"Error in 'search' command: unable to parse the search: Comparator '=' is missing a term on the right hand side."

my guess was when i choose "all time", earliest=$time1.earliest$, which is null. so i tried with double quotes around the tokens.

earliest="$time1.earliest$" latest="$time1.latest$"

no errors occur and no results are found. so how do i correct my search string?

[stephane_cyrill · Accepted solution]

Hi Luies,

I see that you are using splunk 6.2 if it is the case we change earliestTime and latestTime into earliest and latest in your input setting

Try to to use the time range like this:enter code here

<search>
 <query>
     index=ha  "ha_fids: Terminating CM"  
     | eval time=_time  
     | stats count by time 
     | SORT -time 
     | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(time)
     | rename time as WarningTime 
     | table WarningTime 
 </query>
<earliest>$time1.earliest$</earliest>
<latest>$time1.latest$</latest>
</search>

[thirumalreddyb]

What if those tokens should work on a sub-search?

[markthompson]

Your problem here is that "All time" doesn't use an earliest or latest time, it simply searches through everything. Which is probably whats causing your error, Why are you using earliest and latest time in your searches? Surely you should use a timepicker in your dashboard and use those values as your search string.