Reporting

Saved searches time modifier in dashboard not working.

gljiva
Path Finder

Hi, I'm having a problem using a saved search in multiple dashboards with different time modifiers (earliestTime and latestTime). As I understand saved searches are just search strings that are named (templates) that can be referenced by name in dashboards and alerts. If I define simple search in savedsearches.conf (without specifying time modifiers) and try to modify time with earliestTime and latestTime xml tags, returned results are not affected by these modifiers and no matter what I specify for time, results are always the same.
Is it even possible to use same search and define different time modifiers in different dashboards? I have a search that would like to use as a template and only change time for different dashboards, so if I modify search string I don't have to go trough all dashboards and modify all searches.

<chart>
<title>Search title</title>
<searchName>SavedSearchName</searchName>
<earliestTime>-7d@d</earliestTime>
<latestTime>-4d@d</latestTime>
</chart>

thx.

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

A saved search actually includes its own earliest and latest time arguments. You're using the simplified XML and I think because it sees the <searchName> argument, it completely ignores the <earliestTime> and <latestTime> arguments. In general the simplified XML will be completely tolerant of meaningless XML like <chicken /> so its not always true that it's paying attention to you. 😃

You can switch to the advanced XML, in which case you'd use a HiddenSavedSearch module to specify the saved search and then you'd nest a HiddenSearch inside it, setting only the earliest and latest params to override the timerange.

View solution in original post

sideview
SplunkTrust
SplunkTrust

A saved search actually includes its own earliest and latest time arguments. You're using the simplified XML and I think because it sees the <searchName> argument, it completely ignores the <earliestTime> and <latestTime> arguments. In general the simplified XML will be completely tolerant of meaningless XML like <chicken /> so its not always true that it's paying attention to you. 😃

You can switch to the advanced XML, in which case you'd use a HiddenSavedSearch module to specify the saved search and then you'd nest a HiddenSearch inside it, setting only the earliest and latest params to override the timerange.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...