Quantcast
Viewing all articles
Browse latest Browse all 47296

Drilldown: Use starttime of bar in timechart as `earliest` field in subsequent search

After spending hours unsuccessfully searching the splunk answers for a solution I would like to phrase my question: I have a timechart which I display in a dashboard. When I click on a bar, I would like that a new search is triggered with the time interval matching that of the clicked bin in the timechart. Unfortunately, using $earliest$$latest$ does not give me the timeinterval of the clicked bin, but of the whole timechart query. On the other hand $click.value$ does give me right start time, but in the following format 2017-09-29T01:00:00.000-04:00 which I then can't use to set my field in the query. I could reformat the $click.value$ string to the expected epoch format, using strftime("2017-09-27T22:04:00.000-04:00", "%Y-%m-%dT%H:%M:%S.%3N-%:z") but I don't know if I can run this command as a script in the dashboard xml. Does anybody have a solution for this? I am a bit amazed that this is such a struggle, seams like a common use-case.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>