Reporting

Saved search gets "destroyed" when opening in search edit

zaphod1984
Path Finder

I have the following search:

sourcetype="renderer" earliest=-3mon latest=now rdr_time>0 | timechart span=1d count by rdr_template

everything works fine.
when i open that search in the search manager it opens correctly but within a second it gets completely messed up and results in this:

sourcetype="renderer" earliest==now rdr_time>0 | timechart span=rdr_template

(notice the '==' or the 'span=rdr_template')
after saving of course the search does not make any sense and fails.

has anybody an idea why this happens and what can be done? thx!

Tags (2)
0 Karma
1 Solution

zaphod1984
Path Finder

it was a browser plugin that was a little eager on changing my window content...

View solution in original post

0 Karma

zaphod1984
Path Finder

i figured it out, it was a strange browser plugin, so no bug at all.
thx anyway! 🙂

0 Karma

zaphod1984
Path Finder

it was a browser plugin that was a little eager on changing my window content...

0 Karma

jkat54
SplunkTrust
SplunkTrust

bug report?

0 Karma

zaphod1984
Path Finder

i have no idea. 🙂
it looks like something is wrong with an piece of javascript that tries to do some kind of transformation on the query.

0 Karma

kristian_kolb
Ultra Champion

Go FF!

Could it be some security feature regarding XSS that is different between the browsers?

/k

0 Karma

zaphod1984
Path Finder

in firefox it actually works, in chrome (latest version) it doesnt...

0 Karma

kristian_kolb
Ultra Champion

Hmm, change to a different browser?

zaphod1984
Path Finder

exactly the same does happen.
it appears that a javascript changes the search after the page has been loaded.

0 Karma

kristian_kolb
Ultra Champion

What happens if you just remove the latest=now? It's not really needed.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...