Hi,
I'm trying to create a dynamic drilldown, more of a side-drill really.
I have a "timechart" bar chart showing a count of "Transcodes" that have started across a 15min span. Each transcode has a filename associated with it, what I'd like to do is have a table to the side of the chart which would list the filenames that the chart is referring to once a bar gets clicked on.
Trouble is, using:
$earliest$ $latest$
Sends an epoch time for the entire scale of the chart (from 24hrs to "now), not the time frame where the bar in the chart is situated.
Is my problem here? - From: http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/EventHandlerReference
"earliest/latest Time range of the clicked chart segment, or if not applicable, the time range of the search. "?
How can I get the clicked segment to send the correct times?
Any help is appreciated, Cheers
Chris
The Chart Code:
Transcodes Started index=forwarded OR sourcetype=mule2 statusDetails="Transcode started" | dedup filename | timechart span=15m count(filename) as "Trancode Started" by statusDetails | rename _time as Time | convert ctime(Time) -24h@h now $earliest$ $latest$
And the Table Code:
![alt text][1]
[1]: /storage/temp/157246-capture.png
↧