Reporting

Saved search gets "destroyed" when opening in search edit

zaphod1984
Path Finder

I have the following search:

sourcetype="renderer" earliest=-3mon latest=now rdr_time>0 | timechart span=1d count by rdr_template

everything works fine.
when i open that search in the search manager it opens correctly but within a second it gets completely messed up and results in this:

sourcetype="renderer" earliest==now rdr_time>0 | timechart span=rdr_template

(notice the '==' or the 'span=rdr_template')
after saving of course the search does not make any sense and fails.

has anybody an idea why this happens and what can be done? thx!

Tags (2)
0 Karma
1 Solution

zaphod1984
Path Finder

it was a browser plugin that was a little eager on changing my window content...

View solution in original post

0 Karma

zaphod1984
Path Finder

i figured it out, it was a strange browser plugin, so no bug at all.
thx anyway! 🙂

0 Karma

zaphod1984
Path Finder

it was a browser plugin that was a little eager on changing my window content...

0 Karma

jkat54
SplunkTrust
SplunkTrust

bug report?

0 Karma

zaphod1984
Path Finder

i have no idea. 🙂
it looks like something is wrong with an piece of javascript that tries to do some kind of transformation on the query.

0 Karma

kristian_kolb
Ultra Champion

Go FF!

Could it be some security feature regarding XSS that is different between the browsers?

/k

0 Karma

zaphod1984
Path Finder

in firefox it actually works, in chrome (latest version) it doesnt...

0 Karma

kristian_kolb
Ultra Champion

Hmm, change to a different browser?

zaphod1984
Path Finder

exactly the same does happen.
it appears that a javascript changes the search after the page has been loaded.

0 Karma

kristian_kolb
Ultra Champion

What happens if you just remove the latest=now? It's not really needed.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...