Splunk Search

Why edits to timespan of dashboard panel don't save?

dawfun
New Member

v6.0, I've got a dashbaord with several panels. I'm using a searchTemplate to populate the dashboard, and then searchPostProcess to filter for each panel. When I am in "edit panels" mode, and then select "Edit Search String" I have the option to set the timespan of the panel search. One panel in particular has a timechart span=1w, and I'd like it to snap to @w1. When I set the earliest time to -5w@w1 and hit save, I'm returned to the dashboard and my chart looks good--snapping to @w1. If leave the dashboard and come back to it, my changes are no longer reflected in the panel.

I've tried editing the XML directly (Simple XML), and tried a lot of different guesses as where I can set this snap-to configuration, but no luck. Can anyone help me out?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In SimpleXML you can use the earliestTime and latestTime tags like this:

...
<row>
  <panel>
    <chart>
      <earliestTime>-5w@w1</earliestTime>
      <latestTime>now</latestTime>
      ...
    </chart>
  </panel>
  ...
</row>
...
0 Karma

dawfun
New Member

Yep. Already doing that. It doesn't seem to influence which day of the week the timechart buckets snap to. Like I said, I can get it to work fine until I reload the page, then it reverts back to some unfindable setting somewhere. I think it's a bug, but want to make sure I'm not doing something wrong.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...