Splunk Search

Invalid Earliest_time in Splunk dashboard

Explorer

I am trying to make a dashboard with a custom time by editing the XML and giving the time in tag. I have tried all possible time formats as given in the document but everytime i am getting an error "Invalid earliest_time".
I have given the sample of the xml below.





Search String
Dashboard Title
5/11/2013:20:00:00
12/11/2013:20:00:00


Any help is appreciated.

Thanks in Advance.

Path Finder

In poking through the returned data - when it did work it looks like the format should be.

YYYY-MM-DDTHH:MM:SS

Example: 2015-05-02T07:30:00

You can also append your timezone at the end as well. Really this is way harder than it should be.

0 Karma

Influencer

In XML You can specify the time as relative time or absolute time. For absolute time it should be in epoch format.

Check this link. http://docs.splunk.com/Documentation/Splunk/6.1.2/Viz/PanelreferenceforSimplifiedXML#earliestTime

For relative time modifiers check section Specify relative time ranges in your search in http://docs.splunk.com/Documentation/Splunk/6.1.2/Search/Specifytimemodifiersinyoursearch

0 Karma