Splunk Search

Why does the time range picker return events for Last 24 Hours, but not for Date and Time for the same time range?

disha
Contributor

HI,

My search is
index=aa sourcetype=windows_server_hourly | rex field=host "(?[a-z0-9-]+).*" | eval "Server Name"=upper(shortname)|search "Server Name"="$Server Name$" counter="% Processor Time" | eval AVG=round(avg,2) | timechart span=1h values(AVG) AS AVG by "Server Name"
In SImple XML code :

  <label>Time Range</label>
  <default>
    <earliestTime>-24h</earliestTime>
    <latestTime>now</latestTime>
  </default>
</input>


<chart>
  <title>Processor Utilization</title>
  <searchString>
    <![CDATA[index=aa sourcetype=windows_server_hourly | rex field=host "(?<shortname>[a-z0-9-]+).*" | eval "Server Name"=upper(shortname)|search "Server Name"="$Server Name$" counter="% Processor Time" | eval AVG=round(avg,2) | timechart span=1h values(AVG) AS AVG by "Server Name"]]>
  </searchString>
  <earliestTime>$earliest$</earliestTime>
  <latestTime>$latest$</latestTime>

...
...

When I search Last 24 hours It shows the events. But if I select the same time range with Date & Time Range option, It says "no events found":
Why is this strange thing happening? Do we need to write something specific in search to take care of this.

Please suggest. Thanks in advance.

0 Karma

woodcock
Esteemed Legend

First of all get rid of everything outside of the square brackets (including the square brackets). Do you have a "fieldest" portion of your XML form to set the $earliest$ and $latest$ tokens? If show, you need to included it (actually include all of your XML).

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...