Dashboards & Visualizations

Saved search time modifier in simple XML dashboard not working


I am writing a simple XML dashboard (so I can do scheduled PDF reporting) in Splunk 5.0.5.

I want to do a side-by-side graph of a saved search:

      <title>Internet Inbound Destination IP (Yesterday)</title>
      <option name="charting.chart">bar</option>
      <title>Internet Inbound Destination IP (Last 60 Minutes)</title>
      <option name="charting.chart">bar</option>
  </row><!-- 2. -->

But the result is a row with two of the same graphs for "Yesterday".

My saved search is currently like this:

#dispatch.earliest_time = -2d@d
#dispatch.latest_time = @d
search = index=techsecu_summary source="Top-Internet-dst-ip-permitted" | top asa_dstip
action.email.inline = 1
alert.digest_mode = True
alert.suppress = 0
alert.track = 0
auto_summarize = 1
auto_summarize.dispatch.earliest_time = -7d@d

All the lines below "search =" are added for accelerating the search. I previously had the two "dispatch." lines in there but they have been commented out for some time.

A colleague did point this post out to me. But that may very well have been Splunk 4 or earlier. I checked the simple XML references for 5.0.5. It does show the and options for panels.

So, have I hit a bug? Or is this a misunderstanding of the document on my part?

0 Karma


I would check to make sure that there are no other savedsearches.conf files that contain references to H-Top-Internet-dst-ip-permitted, either under etc/apps/... or etc/users/youruser/...

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...