Dashboards & Visualizations

Forms in Splunk 6 not working

benspader
Explorer

I have form in splunk 6 that is not working the error it it is giving me is "Search query is not fully resolved." When I hardcode a number over the $cn1$ variable it works. What am I doing wrong?




eventtype="Lookups" cn1=$cn1$ | stats max(_time) as maxtime min(_time) as mintime | eval difference=maxtime-mintime | eval difference=strftime(difference,"%d DAYS %H hrs:%M m:%S s") | fields difference


type="text" token="cn1">


<!-- Add time range picker -->
<input type="time" searchWhenChanged="true">
  <default>
    <earliestTime>0</earliestTime>
    <latestTime>now</latestTime>
  </default>
</input>



Timeframe from first to last lookup
search


Tags (2)
0 Karma
1 Solution

nfilippi_splunk
Splunk Employee
Splunk Employee

Looks like you have some small syntax issues:

---     <searchtemplate>
+++   <searchTemplate>

---     </searchtemplate>
+++   </searchTemplate>

---     <input> type="text" token="cn1">
+++    <input type="text" token="cn1">

View solution in original post

nfilippi_splunk
Splunk Employee
Splunk Employee

Looks like you have some small syntax issues:

---     <searchtemplate>
+++   <searchTemplate>

---     </searchtemplate>
+++   </searchTemplate>

---     <input> type="text" token="cn1">
+++    <input type="text" token="cn1">

benspader
Explorer

Thank you very much! That was it!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...