Reporting

Saved searches time modifier in dashboard not working.

gljiva
Path Finder

Hi, I'm having a problem using a saved search in multiple dashboards with different time modifiers (earliestTime and latestTime). As I understand saved searches are just search strings that are named (templates) that can be referenced by name in dashboards and alerts. If I define simple search in savedsearches.conf (without specifying time modifiers) and try to modify time with earliestTime and latestTime xml tags, returned results are not affected by these modifiers and no matter what I specify for time, results are always the same.
Is it even possible to use same search and define different time modifiers in different dashboards? I have a search that would like to use as a template and only change time for different dashboards, so if I modify search string I don't have to go trough all dashboards and modify all searches.

<chart>
<title>Search title</title>
<searchName>SavedSearchName</searchName>
<earliestTime>-7d@d</earliestTime>
<latestTime>-4d@d</latestTime>
</chart>

thx.

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

A saved search actually includes its own earliest and latest time arguments. You're using the simplified XML and I think because it sees the <searchName> argument, it completely ignores the <earliestTime> and <latestTime> arguments. In general the simplified XML will be completely tolerant of meaningless XML like <chicken /> so its not always true that it's paying attention to you. 😃

You can switch to the advanced XML, in which case you'd use a HiddenSavedSearch module to specify the saved search and then you'd nest a HiddenSearch inside it, setting only the earliest and latest params to override the timerange.

View solution in original post

sideview
SplunkTrust
SplunkTrust

A saved search actually includes its own earliest and latest time arguments. You're using the simplified XML and I think because it sees the <searchName> argument, it completely ignores the <earliestTime> and <latestTime> arguments. In general the simplified XML will be completely tolerant of meaningless XML like <chicken /> so its not always true that it's paying attention to you. 😃

You can switch to the advanced XML, in which case you'd use a HiddenSavedSearch module to specify the saved search and then you'd nest a HiddenSearch inside it, setting only the earliest and latest params to override the timerange.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...