Splunk Search

How to fill empty latest parameter in URL

mbschriek
Explorer

When I open a dashboard the URL looks like this:

https://....../en-US/app/app_name/dashboard?earliest=0&latest=

However, when my dashboard reloads after a while, after login, the url looks like this:

https://....../en-US/app/app_name/dashboard?earliest=0

Since the latest= disappeared the dashboard states that the graphs are waiting for input. How can I change this behavior and always set latest=now in my dashboard URL, to prevent it from failing after a reload?

0 Karma

niketnilay
Legend

The following field are added by default which tells dashabord to be run for all time.

**earliest=0&latest=**

However the same will not be applied to your query unless you have used Search string time range scope as tokens/Global

If you want to use Time control to for setting latest time as well set it to now instead of empty. If you dont need the same then set Time Range to Explicit so that it takes whatever timerange you provide to the specific query.
i.e. latest=now

Also running Dashboard for All time would not be a recommended approach so earliest should ideally not be set to 0.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketnilay
Legend

Empty latest field is same as latest=now or latest=@s. However, while setting All Time in the Time input control from the Presets, the latest value is set as empty which can not be utilized by panels. So, Edit Panel > Edit Time input and if you have to choose Default time as All Time then instead of choosing All Time from Presets, select Advanced drop down and enter Earliest=0 and Latest=now and click Apply.

Both of the following should work
Latest=now or Latest=@s

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mbschriek
Explorer

Thanks for the reply. The time mechanism in Splunk is known by me. I've used tokens in my dashboard for the time pickers, so the ones in the url are not similar. However, the strange thing behavior is that keeping a dashboard open with the first URL, hibernating a laptop, and starting the dashboard again (URL 1 becomes URL 2) shows an "waiting for input" error in my panel.

0 Karma

SierraX
Communicator

Hi,

when I open a dashboard with a default timepicker on yesterday the browser line looks:

?form.field1.earliest=-1d%40d&form.field1.latest=%40d

and if I use all time (like you)

?form.field1.earliest=0&form.field1.latest=

are you sure the now is not deleted because its not necessary?

HTH
Kind Regards
SierraX

0 Karma

SierraX
Communicator

btw %40 == @

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>