Dashboards & Visualizations

Why are the two base searches throw warnings in a dashboard?

macadminrohit
Contributor

I have two base searches in a dashboard, not sure if that is at all possible. But as soon as i use the second base search created, i get warnings with this :

$timer.earliest$
$timer.latest$

Warning is : Unknown node is not allowed here. Before creating the second base search this warning was not existing.

macadminrohit
Contributor

I think i found the mistake, I should be using the timer tokens only in the base search whereas i was using in all the sub searches 🙂

cmerriman
Super Champion

You're exactly right, @macadminrohit . Base searches only require earliest and latest in the base search itself and do not expect them to be called out in any of the searches referencing them. I will move your comment to an answer if you'd like to accept it and close out the question.

azdale
Engager

Hello,
I think the time picker should also be included in your base search. So that its something like this. What do you currently have?

"base search query"

$TimeRangePkr.earliest$

$TimeRangePkr.latest$

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...