Splunk Search

Why would a time filter working in search but not in the dashboard?

cromm
Explorer

I built a dashboard and am trying to include a time filter on Purchase Date and not the default _time field. At first I tried removing the _time field and renaming PurDate as _time but that did not work.

Then I added the following bit of code and I was able to filter results in search but it does not work in the dashboard.
Why won't my dashboard update when I change the time filter but does change in search?

| search
[| makeresults
| addinfo
| eval info_max_time=if(info_max_time=="+Infinity", now(), info_max_time)
| eval foo="PurDate>=".info_min_time." AND PurDate<".info_max_time
| table foo
| rename foo as search]

Here is the source code for one of the pannels
`


-24h@h
now

<panel>
  <title>License Status</title>
  <chart>
    <search>
      <query>| from inputlookup:"customer.csv" 
                         | where (Region="NW") AND (IsActive="True")
                         | eval productName=split("Train##Car##Truck##Bike##Scooter","##") 
                               | mvexpand productName
                         | lookup Purchases.csv customerID productName OUTPUT PurDate
                         | eval PurDate=strptime(FirstPurDate,"%Y-%m-%d")
                         | search 
                             [| makeresults 
                             | addinfo 
                             | eval info_max_time=if(info_max_time=="+Infinity", now(), info_max_time) 
                             | eval foo="FirstPurDate>=".info_min_time." AND PurDate<".info_max_time 
                             | table foo 
                             | rename foo as search]`
0 Karma

DalJeanis
Legend

1) As @poete suggested, you need to use &gt; and &lt; in the panel code for > and <.

2) Do not assign a value to info_max_time - that field is set at the search level. Use another variable name.

3) Make sure that your underlying variables (FirstPurDate) are stored in epoch format.

0 Karma

poete
Builder

Hello @cromm,

I think you should try using &lt; and &gt; instead if < and > in your panel code.
Can you please try this?

somesoni2
Revered Legend

What was the time range used when you ran this in search page?

0 Karma

cromm
Explorer

I tried a few different options like date ranges (ex. 05/01/2018 through today) and presets (ex. current fiscal year). they all worked in the search but the dashboard would not change from what I last did in the search

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...