After spending hours unsuccessfully searching the splunk answers for a solution I would like to phrase my question:
I have a timechart which I display in a dashboard.
When I click on a bar, I would like that a new search is triggered with the time interval matching that of the clicked bin in the timechart.
Unfortunately, using
$earliest$ $latest$
does not give me the timeinterval of the clicked bin, but of the whole timechart query.
On the other hand
$click.value$
does give me right start time, but in the following format
2017-09-29T01:00:00.000-04:00
which I then can't use to set my field
in the query.
I could reformat the $click.value$ string to the expected epoch format, using
strftime("2017-09-27T22:04:00.000-04:00", "%Y-%m-%dT%H:%M:%S.%3N-%:z")
but I don't know if I can run this command as a script in the dashboard xml.
Does anybody have a solution for this? I am a bit amazed that this is such a struggle, seams like a common use-case.
↧