I’ve been running into an issue with the Splunk query which have been using since long time and seeing the following error message: “Please select a shorter time duration for your query,” even when I’m using a 5-minute time range. I noticed that this error seems to pop up when we use latest=now() in our queries to get the most recent data.However, when I tried the same query with a specific time range, like earliest=-xxh@h latest=-xxh@h, it worked just fine. Any ideas on why latest=now() might not be fetching results as expected? And if there is any resolution to working with latest=now() ... View more

</input> <input type="dropdown" token="project"> <label>Project</label> <choice value="tok1*">Token1</choice> <choice value="tok2*">Token2</choice> <default>tok1</default> <initialValue>tok1</initialValue> <change> <condition value="tok1"> <set token="x-key">key1-</set> </condition> <condition value="tok2"> <set token="x-key">key2-</set> </condition> </change> </input> <input type="multiselect" token="minorstate"> <label>minorstate</label> <choice value="*">All</choice> <choice value="&quot;a&quot;, &quot;b&quot;, &quot;c&quot;, &quot;d&quot;,">Minorstate</choice> <default>"""a"", ""b"", ""c"", ""d""</default> <prefix>(</prefix> <suffix>)</suffix> <initialValue>a,"b","c","d"</initialValue> <valuePrefix>"</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> , </delimiter> <fieldForLabel>minorstate</fieldForLabel> <fieldForValue>minorstate</fieldForValue> <search> <query>index=dunamis* sourcetype=dunamis_* producer=dunamis project=$project$ "x-key=$x-key$" | stats count by minorstate</query> <earliest>-15m</earliest> <latest>now</latest> </search> </input> The variables $project$ and $x-key$ are not getting replaced by the values that are being set in the dropdown. Can someone please help? Thank you! ... View more