Dashboards & Visualizations

Time Picker Doesn't Always Work in Dashboard

genesiusj
Builder

Hello,
I have a time picker in my dashboard. It works only some of the time.

If I select a preset like Today or Last 24 hours, it works.
earliest=@d AND latest=now
earliest=-24h@h AND latest=now

If I select Since from the Date Range or Date & Time Range, it fails. My other drop downs display "Could not create search." beneath them.
earliest=1569902400 AND latest=
earliest=1569952800 AND latest=

I don't understand why the latest is not being populated with now().

For Date Range or Date & Time Range if I select Between for either of them it works. However, if I chose Before, this fails as well.
earliest= AND latest=1569902400

I don't understand why the earliest is not being populated with "some time".

Thanks and God bless,
Genesius

0 Karma
1 Solution

genesiusj
Builder

I found the problem.

I am using the tokens in 7 different sub-searches with this dashboard panel.
Removing these tokens from the sub-searches and just adding

<earliest>$Selected_Time_Range.earliest$</earliest>
<latest>$Selected_Time_Range.latest$</latest>

after the close query tag caused it to work.

Thanks and God bless,
Genesius

View solution in original post

0 Karma

genesiusj
Builder

I found the problem.

I am using the tokens in 7 different sub-searches with this dashboard panel.
Removing these tokens from the sub-searches and just adding

<earliest>$Selected_Time_Range.earliest$</earliest>
<latest>$Selected_Time_Range.latest$</latest>

after the close query tag caused it to work.

Thanks and God bless,
Genesius

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...