Reporting

Saved search gets "destroyed" when opening in search edit

zaphod1984
Path Finder

I have the following search:

sourcetype="renderer" earliest=-3mon latest=now rdr_time>0 | timechart span=1d count by rdr_template

everything works fine.
when i open that search in the search manager it opens correctly but within a second it gets completely messed up and results in this:

sourcetype="renderer" earliest==now rdr_time>0 | timechart span=rdr_template

(notice the '==' or the 'span=rdr_template')
after saving of course the search does not make any sense and fails.

has anybody an idea why this happens and what can be done? thx!

Tags (2)
0 Karma
1 Solution

zaphod1984
Path Finder

it was a browser plugin that was a little eager on changing my window content...

View solution in original post

0 Karma

zaphod1984
Path Finder

i figured it out, it was a strange browser plugin, so no bug at all.
thx anyway! 🙂

0 Karma

zaphod1984
Path Finder

it was a browser plugin that was a little eager on changing my window content...

0 Karma

jkat54
SplunkTrust
SplunkTrust

bug report?

0 Karma

zaphod1984
Path Finder

i have no idea. 🙂
it looks like something is wrong with an piece of javascript that tries to do some kind of transformation on the query.

0 Karma

kristian_kolb
Ultra Champion

Go FF!

Could it be some security feature regarding XSS that is different between the browsers?

/k

0 Karma

zaphod1984
Path Finder

in firefox it actually works, in chrome (latest version) it doesnt...

0 Karma

kristian_kolb
Ultra Champion

Hmm, change to a different browser?

zaphod1984
Path Finder

exactly the same does happen.
it appears that a javascript changes the search after the page has been loaded.

0 Karma

kristian_kolb
Ultra Champion

What happens if you just remove the latest=now? It's not really needed.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...