Reporting

Saved search gets "destroyed" when opening in search edit

zaphod1984
Path Finder

I have the following search:

sourcetype="renderer" earliest=-3mon latest=now rdr_time>0 | timechart span=1d count by rdr_template

everything works fine.
when i open that search in the search manager it opens correctly but within a second it gets completely messed up and results in this:

sourcetype="renderer" earliest==now rdr_time>0 | timechart span=rdr_template

(notice the '==' or the 'span=rdr_template')
after saving of course the search does not make any sense and fails.

has anybody an idea why this happens and what can be done? thx!

Tags (2)
0 Karma
1 Solution

zaphod1984
Path Finder

it was a browser plugin that was a little eager on changing my window content...

View solution in original post

0 Karma

zaphod1984
Path Finder

i figured it out, it was a strange browser plugin, so no bug at all.
thx anyway! 🙂

0 Karma

zaphod1984
Path Finder

it was a browser plugin that was a little eager on changing my window content...

0 Karma

jkat54
SplunkTrust
SplunkTrust

bug report?

0 Karma

zaphod1984
Path Finder

i have no idea. 🙂
it looks like something is wrong with an piece of javascript that tries to do some kind of transformation on the query.

0 Karma

kristian_kolb
Ultra Champion

Go FF!

Could it be some security feature regarding XSS that is different between the browsers?

/k

0 Karma

zaphod1984
Path Finder

in firefox it actually works, in chrome (latest version) it doesnt...

0 Karma

kristian_kolb
Ultra Champion

Hmm, change to a different browser?

zaphod1984
Path Finder

exactly the same does happen.
it appears that a javascript changes the search after the page has been loaded.

0 Karma

kristian_kolb
Ultra Champion

What happens if you just remove the latest=now? It's not really needed.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...