Other Usage

How can I define to time range in panel without timerange picker?

GioCortez
Explorer

Hello. I'm creating a dashboard which will then be used as a monthly report, with some statistics in it. I will use pdf delivery, so that i have avoided using any timerange picker in it.

Point is, without timerange picker, how can i define to run the search for -30d@d until -1d@d in all my panels?

Labels (1)
0 Karma

GioCortez
Explorer

Works fine for the dashboard itself, but when i try "Schedule PDF" it tells me "Invalid earliest_time" on the PDF. 

I'm running crazy. i'm ok having no forms/inputs on a to-be-scheduled dashboard, but where/how should i define the time range it shall run for?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It sounds like the <init> element is not being processed.  Have you tried hardcoding the <earliest> and <latest> elements in each panel to "-30d@d" and "-1d@d", respectively?  If that fails then you might try adding earliest=-30d@d latest=-1d@d to each query.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can create tokens for earliest and latest without a time picker by using an <init> element.

<init>
  <set name="start">-30d@d</set>
  <set name="end">-1d@d</set>
</init>

Then use the tokens in your <search> elements.

<search>
  <query>... </query>
  <earliest>$start$</earliest>
  <latest>$end$</latest>
</search>
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...