Splunk Search

Why would a time filter working in search but not in the dashboard?

Explorer

I built a dashboard and am trying to include a time filter on Purchase Date and not the default _time field. At first I tried removing the _time field and renaming PurDate as _time but that did not work.

Then I added the following bit of code and I was able to filter results in search but it does not work in the dashboard.
Why won't my dashboard update when I change the time filter but does change in search?

| search
[| makeresults
| addinfo
| eval info_max_time=if(info_max_time=="+Infinity", now(), info_max_time)
| eval foo="PurDate>=".info_min_time." AND PurDate<".info_max_time
| table foo
| rename foo as search]

Here is the source code for one of the pannels
`


-24h@h
now

<panel>
  <title>License Status</title>
  <chart>
    <search>
      <query>| from inputlookup:"customer.csv" 
                         | where (Region="NW") AND (IsActive="True")
                         | eval productName=split("Train##Car##Truck##Bike##Scooter","##") 
                               | mvexpand productName
                         | lookup Purchases.csv customerID productName OUTPUT PurDate
                         | eval PurDate=strptime(FirstPurDate,"%Y-%m-%d")
                         | search 
                             [| makeresults 
                             | addinfo 
                             | eval info_max_time=if(info_max_time=="+Infinity", now(), info_max_time) 
                             | eval foo="FirstPurDate>=".info_min_time." AND PurDate<".info_max_time 
                             | table foo 
                             | rename foo as search]`
0 Karma

SplunkTrust
SplunkTrust

1) As @poete suggested, you need to use &gt; and &lt; in the panel code for > and <.

2) Do not assign a value to info_max_time - that field is set at the search level. Use another variable name.

3) Make sure that your underlying variables (FirstPurDate) are stored in epoch format.

0 Karma

Builder

Hello @cromm,

I think you should try using &lt; and &gt; instead if < and > in your panel code.
Can you please try this?

SplunkTrust
SplunkTrust

What was the time range used when you ran this in search page?

0 Karma

Explorer

I tried a few different options like date ranges (ex. 05/01/2018 through today) and presets (ex. current fiscal year). they all worked in the search but the dashboard would not change from what I last did in the search

0 Karma