Hi,
I have a single value in my dashboard, i want users to be able to drilldown on this value. When they do a new search has to be executed. We run version 6.5.2 so we dont yet have the drilldowneditor.
I thougt i just could add this to the source:
drilldown>search?q=index=zzz earliest=-h sourcetype= "xxx" OR sourcetype="yyyy"
| eval eA_Z=strptime(A_Z,"%Y-%m-%d %H:%M:%S.%N")
| eval eD_A_I=coalesce(strptime(eD_A_I, "%Y-%m-%d %H:%M:%S.%N"),now())
| eval G_w =floor((eD_A_I-eA_Z)/86400)
| search G_w <= 14
But this does not work. Why not?
↧