Dashboards & Visualizations

Default time range for Dashboard input search query without earliest and latest tags

New Member

Dear Splunk users,
I am working on an existing dashboard with certain inputs. These inputs are dynamically populated and uses a search query for that. However to filter the events on time, I see a token being used with "where" clause and the xml-tags <earliest> and <latest> are removed. I am just curious what is the default time range does the search pick in this case? The original token uses 2weeks span. I have attached source here. 

I would really appreciate if you can provide references to your answers on splunk docs. Thanks and happy splunking 🙂

I am just wondering if the search for this input uses all-time


    <input type="multiselect" token="Baseline" searchWhenChanged="true">
      <choice value="*">All (including unplanned)</choice>
      <choice value="RB*">All (planned only)</choice>
      <choice value="undefined">Unplanned</choice>
        <query>index=abcd sourcetype="xyz"
| where strftime(_time, "%F")=$TIME_FILTER$
|dedup Baseline
|sort Baseline</query>
      <delimiter> OR </delimiter>


Token to filter time


    <input type="dropdown" searchWhenChanged="true" token="TIME_FILTER">
      <label>Time Picker</label>
          <condition match="$result.today$!=$result.latestDate$">
            <set token="LATEST_DATE">$result.latestDate$</set>
            <unset token="LATEST_DATE"></unset>
        <query>| loadjob `savedsearch(xyz, $env:app$)`
| fields _time
| eval ttime = strftime(_time, "%F")
| eval today = strftime(now(), "%F")
| dedup ttime
| eventstats latest(ttime) as latestDate</query>


Labels (2)
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...