Splunk Search
Highlighted

Why edits to timespan of dashboard panel don't save?

New Member

v6.0, I've got a dashbaord with several panels. I'm using a searchTemplate to populate the dashboard, and then searchPostProcess to filter for each panel. When I am in "edit panels" mode, and then select "Edit Search String" I have the option to set the timespan of the panel search. One panel in particular has a timechart span=1w, and I'd like it to snap to @w1. When I set the earliest time to -5w@w1 and hit save, I'm returned to the dashboard and my chart looks good--snapping to @w1. If leave the dashboard and come back to it, my changes are no longer reflected in the panel.

I've tried editing the XML directly (Simple XML), and tried a lot of different guesses as where I can set this snap-to configuration, but no luck. Can anyone help me out?

0 Karma
Highlighted

Re: Why edits to timespan of dashboard panel don't save?

SplunkTrust
SplunkTrust

In SimpleXML you can use the earliestTime and latestTime tags like this:

...
<row>
  <panel>
    <chart>
      <earliestTime>-5w@w1</earliestTime>
      <latestTime>now</latestTime>
      ...
    </chart>
  </panel>
  ...
</row>
...
0 Karma
Highlighted

Re: Why edits to timespan of dashboard panel don't save?

New Member

Yep. Already doing that. It doesn't seem to influence which day of the week the timechart buckets snap to. Like I said, I can get it to work fine until I reload the page, then it reverts back to some unfindable setting somewhere. I think it's a bug, but want to make sure I'm not doing something wrong.

0 Karma