Hello! Still very new to Splunk so hoping to get some clarification. My dashboard is currently using a post-process search as its base and filtering data from there. On my dashboard objects, I have a <link></link> which works fine until adding an eval strftime to convert the time to human readable. Running this search as a new search manually with the eval works fine. However, the link directs to a blank search. Removing the eval statement makes the link work. Link: <link target="_blank"> search?q=| inputlookup io_vuln_data_lookup where $severity$ | search last_found >= "$info_min_time$" AND last_found <= "$info_max_time$" | eval last_found = strftime(last_found, "%c") | table dns_name, last_found | where lower(state)!="fixed" </link> I was hoping to only do this conversion for a single dashboard object, so didn't want to convert the entire lookup. Would be amazing if I could get this search to work 🙂 Thanks!
... View more