Dashboards & Visualizations

Time Picker Doesn't Always Work in Dashboard

genesiusj
Builder

Hello,
I have a time picker in my dashboard. It works only some of the time.

If I select a preset like Today or Last 24 hours, it works.
earliest=@d AND latest=now
earliest=-24h@h AND latest=now

If I select Since from the Date Range or Date & Time Range, it fails. My other drop downs display "Could not create search." beneath them.
earliest=1569902400 AND latest=
earliest=1569952800 AND latest=

I don't understand why the latest is not being populated with now().

For Date Range or Date & Time Range if I select Between for either of them it works. However, if I chose Before, this fails as well.
earliest= AND latest=1569902400

I don't understand why the earliest is not being populated with "some time".

Thanks and God bless,
Genesius

0 Karma
1 Solution

genesiusj
Builder

I found the problem.

I am using the tokens in 7 different sub-searches with this dashboard panel.
Removing these tokens from the sub-searches and just adding

<earliest>$Selected_Time_Range.earliest$</earliest>
<latest>$Selected_Time_Range.latest$</latest>

after the close query tag caused it to work.

Thanks and God bless,
Genesius

View solution in original post

0 Karma

genesiusj
Builder

I found the problem.

I am using the tokens in 7 different sub-searches with this dashboard panel.
Removing these tokens from the sub-searches and just adding

<earliest>$Selected_Time_Range.earliest$</earliest>
<latest>$Selected_Time_Range.latest$</latest>

after the close query tag caused it to work.

Thanks and God bless,
Genesius

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...