Time comparison different results in search and dashboar

[Ste]

Dear experts

Why is the following line

| where my_time>=relative_time(now(),"-1d@d") AND my_time<=relative_time(now(),"@d")

Accepted as a valid statement in a search window, but as soon I want to use exactly this code in a dashboard, I get the error message: "Error in line 100: Unencoded <" ?

The dashboard code validator somehow fails with the <= comparison. 

>= works, as well = but not <= 

We're on splunkcloud. 

[luizlimapg · Accepted solution]

Hi @Ste, how are you?

Is &gt; for >
Your SPL is using &gr; instead.

| where my_time>=relative_time(now(),"-1d@d") AND my_time<=relative_time(now(),"@d")

[yuanliu]

@luizlimapg is correct.  If you copy and paste your search into Simple XML code window (or Dashboard Studio code window for that matter), some special characters will be interpreted by the XML engine (or the JSON engine).  If you need to do that, use HTML entities to represent these special characters.

It is best to avoid this, however.  If you have a panel, copy and paste your search code into the Search popup. (Similarly in the search box under Input.)

[gcusello]

Hi @Ste ,

in dashboards, you cannot use <> and you have to replace them with &lt; and &gt;

| where my_time&gr;=relative_time(now(),"-1d@d") AND my_time<=relative_time(now(),"@d")

Ciao.

giuseppe

[Ste]

Using the html tags from your proposal would lead into the error message "Error in Line 100: Invalid character entity"

[gcusello]

Hi @Ste ,

Please share the code of your dashboard with the error using the "Insert/Edit Code Cample" button.

Ciao.

Giuseppe

[Ste]

Gentlemen you're right

Search code:

| where my_time>=relative_time(now(),"-1d@d") AND _time<=relative_time(now(),"@d")

updated to 

| where my_time >=relative_time(now(),"-1d@d") AND _time <=relative_time(now(),"@d")

will work in a dashboard.

I started from scratch with all my trials and were not able to reproduce my issues with the html tags. 

This must be a classic PIBCAK (Problem Is Between Chair and Keyboard)