Splunk Search

How to fill empty latest parameter in URL

mbschriek
Explorer

When I open a dashboard the URL looks like this:

https://....../en-US/app/app_name/dashboard?earliest=0&latest=

However, when my dashboard reloads after a while, after login, the url looks like this:

https://....../en-US/app/app_name/dashboard?earliest=0

Since the latest= disappeared the dashboard states that the graphs are waiting for input. How can I change this behavior and always set latest=now in my dashboard URL, to prevent it from failing after a reload?

0 Karma

niketn
Legend

The following field are added by default which tells dashabord to be run for all time.

**earliest=0&latest=**

However the same will not be applied to your query unless you have used Search string time range scope as tokens/Global

If you want to use Time control to for setting latest time as well set it to now instead of empty. If you dont need the same then set Time Range to Explicit so that it takes whatever timerange you provide to the specific query.
i.e. latest=now

Also running Dashboard for All time would not be a recommended approach so earliest should ideally not be set to 0.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

Empty latest field is same as latest=now or latest=@s. However, while setting All Time in the Time input control from the Presets, the latest value is set as empty which can not be utilized by panels. So, Edit Panel > Edit Time input and if you have to choose Default time as All Time then instead of choosing All Time from Presets, select Advanced drop down and enter Earliest=0 and Latest=now and click Apply.

Both of the following should work
Latest=now or Latest=@s

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mbschriek
Explorer

Thanks for the reply. The time mechanism in Splunk is known by me. I've used tokens in my dashboard for the time pickers, so the ones in the url are not similar. However, the strange thing behavior is that keeping a dashboard open with the first URL, hibernating a laptop, and starting the dashboard again (URL 1 becomes URL 2) shows an "waiting for input" error in my panel.

0 Karma

SierraX
Communicator

Hi,

when I open a dashboard with a default timepicker on yesterday the browser line looks:

?form.field1.earliest=-1d%40d&form.field1.latest=%40d

and if I use all time (like you)

?form.field1.earliest=0&form.field1.latest=

are you sure the now is not deleted because its not necessary?

HTH
Kind Regards
SierraX

0 Karma

SierraX
Communicator

btw %40 == @

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...