Saved searches time modifier in dashboard not working.

[gljiva]

Hi, I'm having a problem using a saved search in multiple dashboards with different time modifiers (earliestTime and latestTime). As I understand saved searches are just search strings that are named (templates) that can be referenced by name in dashboards and alerts. If I define simple search in savedsearches.conf (without specifying time modifiers) and try to modify time with earliestTime and latestTime xml tags, returned results are not affected by these modifiers and no matter what I specify for time, results are always the same.
Is it even possible to use same search and define different time modifiers in different dashboards? I have a search that would like to use as a template and only change time for different dashboards, so if I modify search string I don't have to go trough all dashboards and modify all searches.

<chart>
<title>Search title</title>
<searchName>SavedSearchName</searchName>
<earliestTime>-7d@d</earliestTime>
<latestTime>-4d@d</latestTime>
</chart>

thx.

[sideview · Accepted solution]

A saved search actually includes its own earliest and latest time arguments. You're using the simplified XML and I think because it sees the <searchName> argument, it completely ignores the <earliestTime> and <latestTime> arguments. In general the simplified XML will be completely tolerant of meaningless XML like <chicken /> so its not always true that it's paying attention to you. 😃

You can switch to the advanced XML, in which case you'd use a HiddenSavedSearch module to specify the saved search and then you'd nest a HiddenSearch inside it, setting only the earliest and latest params to override the timerange.