Splunk Search

Why edits to timespan of dashboard panel don't save?

dawfun
New Member

v6.0, I've got a dashbaord with several panels. I'm using a searchTemplate to populate the dashboard, and then searchPostProcess to filter for each panel. When I am in "edit panels" mode, and then select "Edit Search String" I have the option to set the timespan of the panel search. One panel in particular has a timechart span=1w, and I'd like it to snap to @w1. When I set the earliest time to -5w@w1 and hit save, I'm returned to the dashboard and my chart looks good--snapping to @w1. If leave the dashboard and come back to it, my changes are no longer reflected in the panel.

I've tried editing the XML directly (Simple XML), and tried a lot of different guesses as where I can set this snap-to configuration, but no luck. Can anyone help me out?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In SimpleXML you can use the earliestTime and latestTime tags like this:

...
<row>
  <panel>
    <chart>
      <earliestTime>-5w@w1</earliestTime>
      <latestTime>now</latestTime>
      ...
    </chart>
  </panel>
  ...
</row>
...
0 Karma

dawfun
New Member

Yep. Already doing that. It doesn't seem to influence which day of the week the timechart buckets snap to. Like I said, I can get it to work fine until I reload the page, then it reverts back to some unfindable setting somewhere. I think it's a bug, but want to make sure I'm not doing something wrong.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!