Splunk Search

Why edits to timespan of dashboard panel don't save?

dawfun
New Member

v6.0, I've got a dashbaord with several panels. I'm using a searchTemplate to populate the dashboard, and then searchPostProcess to filter for each panel. When I am in "edit panels" mode, and then select "Edit Search String" I have the option to set the timespan of the panel search. One panel in particular has a timechart span=1w, and I'd like it to snap to @w1. When I set the earliest time to -5w@w1 and hit save, I'm returned to the dashboard and my chart looks good--snapping to @w1. If leave the dashboard and come back to it, my changes are no longer reflected in the panel.

I've tried editing the XML directly (Simple XML), and tried a lot of different guesses as where I can set this snap-to configuration, but no luck. Can anyone help me out?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In SimpleXML you can use the earliestTime and latestTime tags like this:

...
<row>
  <panel>
    <chart>
      <earliestTime>-5w@w1</earliestTime>
      <latestTime>now</latestTime>
      ...
    </chart>
  </panel>
  ...
</row>
...
0 Karma

dawfun
New Member

Yep. Already doing that. It doesn't seem to influence which day of the week the timechart buckets snap to. Like I said, I can get it to work fine until I reload the page, then it reverts back to some unfindable setting somewhere. I think it's a bug, but want to make sure I'm not doing something wrong.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...