Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Get earliest and latest from time filter

$
0
0
I am using a dashboard with some filters including the built int time input for the events. For the queries in the chart Iam using **$duration.earliest$** and **$duration.latest$** for earliest and latest window. It works for the preset duration like last 7 days, 30 days etc but when I click All time it doesnt work. Looking at the query both this are set to empty values. For all time shouldnt the evaluated values be set as **earliest=1 latest=now** ? Similar error when I use realtime when I use real time of 10 day window the query becomes **earliest=rt-10d latest=rtnow** and errors out as " Invalid value "rt-10d" for time term 'earliest'" Rest of Presets, relative and time range works without these issues.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>