Dashboards & Visualizations

Dashboard Input Error When Time Is Set As "All Time"

LuiesCui
Communicator

hey guys, i'm new to splunk and i really need ur help!!!
i built a form with an input

<input type="time" token="time1" searchWhenChanged="true">
  <label>Time</label>
  <default>
    <earliestTime>-24h@d</earliestTime>
    <latestTime>@d</latestTime>
  </default>
</input>

and my search string is

<query>
    index=ha  "ha_fids: Terminating CM"  earliest=$time1.earliest$ latest=$time1.latest$ 
    | eval time=_time  
    | stats count by time 
    | SORT -time 
    | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(time)
    | rename time as WarningTime 
    | table WarningTime 
</query>

everything works fine except an error occurs when i choose "all time" on the input bar :

"Error in 'search' command: unable to parse the search: Comparator '=' is missing a term on the right hand side."

my guess was when i choose "all time", earliest=$time1.earliest$, which is null. so i tried with double quotes around the tokens.

earliest="$time1.earliest$" latest="$time1.latest$"

no errors occur and no results are found. so how do i correct my search string?

Tags (3)
1 Solution

stephane_cyrill
Builder

Hi Luies,

I see that you are using splunk 6.2 if it is the case we change earliestTime and latestTime into earliest and latest in your input setting

Try to to use the time range like this:enter code here

<search>
 <query>
     index=ha  "ha_fids: Terminating CM"  
     | eval time=_time  
     | stats count by time 
     | SORT -time 
     | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(time)
     | rename time as WarningTime 
     | table WarningTime 
 </query>
<earliest>$time1.earliest$</earliest>
<latest>$time1.latest$</latest>
</search>

View solution in original post

stephane_cyrill
Builder

Hi Luies,

I see that you are using splunk 6.2 if it is the case we change earliestTime and latestTime into earliest and latest in your input setting

Try to to use the time range like this:enter code here

<search>
 <query>
     index=ha  "ha_fids: Terminating CM"  
     | eval time=_time  
     | stats count by time 
     | SORT -time 
     | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(time)
     | rename time as WarningTime 
     | table WarningTime 
 </query>
<earliest>$time1.earliest$</earliest>
<latest>$time1.latest$</latest>
</search>

thirumalreddyb
Communicator

What if those tokens should work on a sub-search?

0 Karma

markthompson
Builder

Your problem here is that "All time" doesn't use an earliest or latest time, it simply searches through everything. Which is probably whats causing your error, Why are you using earliest and latest time in your searches? Surely you should use a timepicker in your dashboard and use those values as your search string.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...