Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Dynamic Drill Down on timechart sending full span values, not local to the "bar"

$
0
0
Hi, I'm trying to create a dynamic drilldown, more of a side-drill really. I have a "timechart" bar chart showing a count of "Transcodes" that have started across a 15min span. Each transcode has a filename associated with it, what I'd like to do is have a table to the side of the chart which would list the filenames that the chart is referring to once a bar gets clicked on. Trouble is, using: $earliest$$latest$ Sends an epoch time for the entire scale of the chart (from 24hrs to "now), not the time frame where the bar in the chart is situated. Is my problem here? - From: http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/EventHandlerReference "earliest/latest Time range of the clicked chart segment, or if not applicable, the time range of the search. "? How can I get the clicked segment to send the correct times? Any help is appreciated, Cheers Chris The Chart Code: Transcodes Startedindex=forwarded OR sourcetype=mule2 statusDetails="Transcode started" | dedup filename | timechart span=15m count(filename) as "Trancode Started" by statusDetails | rename _time as Time | convert ctime(Time)-24h@hnow$earliest$$latest$ And the Table Code: index=forwarded earliest=$trans_early$ latest=$trans_late$ filename=* statusDetails="Transcode started" | dedup filename | stats values(filename)0
![alt text][1] [1]: /storage/temp/157246-capture.png

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>