Splunk Search

How to display a time range token

Jamietriplet
Explorer

Hello guys, I am trying to add a time range to my search, so the user can pick any time range and see data for the selected time (e.g. 24hours, last 30 days, previous year etc), . I created a time range control and token for this purpose, called TimeRange. But when I run my query, I get the below error:

Invalid value "$TimeRange$" for time term 'earliest'

Here is my query:
base query earliest = $TimeRange$, latest=now ()
| other query

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your panel will have a search (data source) associated with it - how is that data source configured (with respect to timeframe)?

0 Karma

Jamietriplet
Explorer

index=Index name sourcetype=sourcetype name (field names)earliest=$TimeRange$ latest=now()

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure why you won't show us what you do have - perhaps we might be able to see what is wrong - what you are sharing with us at the moment is not moving things forward.

Jamietriplet
Explorer

Hello @ITWhisperer , I tried this and got this same error:
Invalid value "$TimeRange.earliest$" for time term 'earliest

0 Karma

dural_yyz
Motivator

Please share the source code for the Time Selection dropdown and for the search panel you are referencing the token.

0 Karma

Jamietriplet
Explorer

hello @dural_yyz ,

This is the source code for the control and token

{
    "options": {
        "defaultValue": "-24h@h,now",
        "token": "TimeRange"
    },
    "title": "Time Selection",
    "type": "input.timerange"
}
 
see the picture for the panel 
Screenshot 2024-12-03 130629.png
0 Karma

dural_yyz
Motivator

Share the panel that is referencing the TimeRange with the error.

0 Karma

Jamietriplet
Explorer

Do you mean the control panel?Screenshot 2024-12-03 145254.png

0 Karma

dural_yyz
Motivator

There is a search panel you are trying to pass the variables to.  The panel that gives an error when trying to use the token values.

0 Karma

Jamietriplet
Explorer

index=Index name sourcetype=sourcetype name (field names)earliest=$TimeRange$ latest=now()

0 Karma

dural_yyz
Motivator

@Jamietriplet wrote:

index=Index name sourcetype=sourcetype name (field names)earliest=$TimeRange$ latest=now()


index=Index name sourcetype=sourcetype name (field names)earliest=$TimeRange.earliest$ latest=$TimeRange.latest$
0 Karma

Jamietriplet
Explorer

Its important to note that i wrote a similar line of code for another panel and got no error, see below:

index = index name sourcetype = sourcetype name (field names) earliest =$StartTime$  latest=$FinishTime$
Tags (1)
0 Karma

Jamietriplet
Explorer

Tried this already and got this error:

Invalid value "$TimeRange.earliest$" for time term 'earliest'

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please show what is in your token and how you have set it

0 Karma

Jamietriplet
Explorer

Token was set using the time range control. see below image

Screenshot 2024-12-03 130629.png

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

earliest = $TimeRange.earliest$, latest=$TimeRange.latest$
0 Karma

Jamietriplet
Explorer

Its important to note that i wrote a similar line of code for another panel and got no error, see below:

index = index name sourcetype = sourcetype name (field names) earliest =$StartTime$  latest=$FinishTime$

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...