Splunk Search

Why edits to timespan of dashboard panel don't save?

dawfun
New Member

v6.0, I've got a dashbaord with several panels. I'm using a searchTemplate to populate the dashboard, and then searchPostProcess to filter for each panel. When I am in "edit panels" mode, and then select "Edit Search String" I have the option to set the timespan of the panel search. One panel in particular has a timechart span=1w, and I'd like it to snap to @w1. When I set the earliest time to -5w@w1 and hit save, I'm returned to the dashboard and my chart looks good--snapping to @w1. If leave the dashboard and come back to it, my changes are no longer reflected in the panel.

I've tried editing the XML directly (Simple XML), and tried a lot of different guesses as where I can set this snap-to configuration, but no luck. Can anyone help me out?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In SimpleXML you can use the earliestTime and latestTime tags like this:

...
<row>
  <panel>
    <chart>
      <earliestTime>-5w@w1</earliestTime>
      <latestTime>now</latestTime>
      ...
    </chart>
  </panel>
  ...
</row>
...
0 Karma

dawfun
New Member

Yep. Already doing that. It doesn't seem to influence which day of the week the timechart buckets snap to. Like I said, I can get it to work fine until I reload the page, then it reverts back to some unfindable setting somewhere. I think it's a bug, but want to make sure I'm not doing something wrong.

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...