Splunk Search

[Solution] Dashboard global_time token value not set


For the search record:

I edited an already functional dashboard in the studio, tweaking the layout. Part of that was deleting and relocating the Time Input. Afterwards I was seeing this weirdness on all of the charts:



That started a "what does it mean and where is it coming from" search, eventually becoming an expert in the concept of Splunk tokens.

The problem was the  re-insertion of the Time Input had it put into the wrong area of the dashboard. The solution was to edit the Source of the dashboard and cut and paste the defaults section out of the visualization section that it had been put into, and back into the top section.






"defaults": {
    "dataSources": {
        "ds.search": {
            "options": {
                "queryParameters": {
                    "latest": "$global_time.latest$",
                    "earliest": "$global_time.earliest$"







Additionally the name of the token had been modded to the intuitive value of tr_txndYpSb  when putting back the Time Input so it needed to be changed back to global_time. Once that was done, the dashboard charts worked again.






"inputs": {
    "input_inmCH1Lw": {
        "options": {
            "defaultValue": "-7d@h,now",
            "token": "tr_txndYpSb"
        "title": "Time Range Input Title",
        "type": "input.timerange"







Labels (1)
Tags (1)
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...