Splunk Search

[Solution] Dashboard global_time token value not set


For the search record:

I edited an already functional dashboard in the studio, tweaking the layout. Part of that was deleting and relocating the Time Input. Afterwards I was seeing this weirdness on all of the charts:



That started a "what does it mean and where is it coming from" search, eventually becoming an expert in the concept of Splunk tokens.

The problem was the  re-insertion of the Time Input had it put into the wrong area of the dashboard. The solution was to edit the Source of the dashboard and cut and paste the defaults section out of the visualization section that it had been put into, and back into the top section.






"defaults": {
    "dataSources": {
        "ds.search": {
            "options": {
                "queryParameters": {
                    "latest": "$global_time.latest$",
                    "earliest": "$global_time.earliest$"







Additionally the name of the token had been modded to the intuitive value of tr_txndYpSb  when putting back the Time Input so it needed to be changed back to global_time. Once that was done, the dashboard charts worked again.






"inputs": {
    "input_inmCH1Lw": {
        "options": {
            "defaultValue": "-7d@h,now",
            "token": "tr_txndYpSb"
        "title": "Time Range Input Title",
        "type": "input.timerange"







Labels (1)
Tags (1)
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...