Dashboards & Visualizations

Multiple Time range token used in dashboard search string - 'All time' error

DanielFordWA
Contributor

Hi,

I am having an issue when using multiple time range tokens in the search string.

I have built a dashboard that lets the user select a publisher and the date range over which documents were published.

I have used another time range picker so the user can see the 'Views' of those documents over a selected time period.

Everything works fine unless 'All time' is selected. I get the following error.

"Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the left hand side."

The search string is below.

  <query>index=userdoc 
| search cs_username="INT*" [| search earliest=$pubtime1.earliest$ latest=$pubtime1.latest$ index=userpubdoc | search cs_username=$Pub1token$ publicationId=$PubID1$ | fields publicationId] 
| fillnull value="0" 
| stats sum(count) AS "Client Views" dc(cs_username) AS "Client Users" by publicationId
| fillnull value="0" "Client Views" "Client Users"
| lookup PubDocs2.csv publicationId OUTPUTNEW DocTitle DocType
| table publicationId DocTitle DocType "Client Views" "Client Users"
| eval DocTitle=urldecode(DocTitle)
| eval DocType=urldecode(DocType)</query>
<earliest>$viewtime1.earliest$</earliest>
<latest>$viewtime1.latest$</latest>

Is it possible to use time range tokens this way?

The error occurs when the first time range picker is set to "All Time"

earliest=$pubtime1.earliest$ latest=$pubtime1.latest$

After looking at the job inspector the search string is populated with the below when 'All Time' is selected.

earliest=0 latest=

Is there any way around this?

Hope you can help!

Dan

0 Karma
1 Solution

ramdaspr
Contributor

Try with double quotes around the tokens.

latest="$pubtime1.latest$"

View solution in original post

ramdaspr
Contributor

Try with double quotes around the tokens.

latest="$pubtime1.latest$"

DanielFordWA
Contributor

Thanks, this corrected the issues

0 Karma

DanielFordWA
Contributor

I can confirm only the "All Time" selection causes the error.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...