I have a dashboard that reports CDN Cache hit ratios. I have set this up as a static dashboard to email out to a group of people a performance score for their use. This used to work several months ago but recently my PDFs are showing the following error on all of my result queries:
Invalid earliest_time
I reviewed my source code and set the token fields for earliest and latest times as follows.
<set token="field1.earliest">-7d@d</set>
<set token="field1.latest">now</set>
Variables are then referred to in the searches performed.
What would be causing this return error on my scheduled reports?
It the problem only happening for the pdf? Is the dashboard loading as expected when you are opening it?
Could not reproduce any issues created a dashboard below:
<dashboard version="1.1">
<init>
<set token="field1.earliest">-7d@d</set>
<set token="field1.latest">now</set>
</init>
<label>time_selector</label>
<row>
<panel>
<chart>
<title>Events by sourcetype</title>
<search>
<query>| tstats count where index=_internal by sourcetype</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
<panel>
<chart>
<title>Events by sourcetype</title>
<search>
<query>| tstats count where index=_internal earliest=$field1.earliest$ latest=$field1.latest$ by sourcetype</query>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>
</row>
</dashboard>
Dashboard loads as expected, yes. It's only when scheduling out a PDF export that I start getting errors. Even when previewing the export it shows me that error. If I do a manual export of the dashboard to a PDF that also generates the query as expected, so it's only when scheduling them out that I see this error
Oh that is strange. Look in the _internal index for any clues to the problem.
Search for keys like "sendemail" or "splunk_pdfgen" or "Invalid value"