Other Usage

How can I define to time range in panel without timerange picker?

GioCortez
Explorer

Hello. I'm creating a dashboard which will then be used as a monthly report, with some statistics in it. I will use pdf delivery, so that i have avoided using any timerange picker in it.

Point is, without timerange picker, how can i define to run the search for -30d@d until -1d@d in all my panels?

Labels (1)
0 Karma

GioCortez
Explorer

Works fine for the dashboard itself, but when i try "Schedule PDF" it tells me "Invalid earliest_time" on the PDF. 

I'm running crazy. i'm ok having no forms/inputs on a to-be-scheduled dashboard, but where/how should i define the time range it shall run for?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It sounds like the <init> element is not being processed.  Have you tried hardcoding the <earliest> and <latest> elements in each panel to "-30d@d" and "-1d@d", respectively?  If that fails then you might try adding earliest=-30d@d latest=-1d@d to each query.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can create tokens for earliest and latest without a time picker by using an <init> element.

<init>
  <set name="start">-30d@d</set>
  <set name="end">-1d@d</set>
</init>

Then use the tokens in your <search> elements.

<search>
  <query>... </query>
  <earliest>$start$</earliest>
  <latest>$end$</latest>
</search>
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...