topic Re: Drilldown Time chart in Dashboards & Visualizations

Drilldown Time chart

pasokkum — Wed, 21 Sep 2016 13:26:39 GMT

I have a scheduled search which will run for every 5 hrs for the span of last 24 hrs.. When i drilldown that pie chart i need to pass the time to the new view.. If i pass last 24 hrs time to the view and if i am doing drilldown at 4th hour , it will fetch me the results for last 24 hrs from that particular time.. Hence there is difference in result count.. i need to pass the time when the search has run last time so that the result count will match..

Thanks..!

Re: Drilldown Time chart

sundareshr — Wed, 21 Sep 2016 13:46:57 GMT

See if these tokens give you what you're looking for

$job.earliestTime$: Job start time.
$job.latestTime$: Latest time recorded for the search job.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/tokens#Search_event_elements_and_job_properties

Re: Drilldown Time chart

pasokkum — Thu, 22 Sep 2016 12:16:07 GMT

Can u please give me an example of how to get the earliest time of a scheduled search in html view??

Re: Drilldown Time chart

sundareshr — Thu, 22 Sep 2016 12:57:19 GMT

Like this

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <title>Earliest=$e$</title>
        <search ref="SavedReport">
          <done>
            <set token="e">$job.earliestTime$</set>
          </done>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</dashboard>

Re: Drilldown Time chart

pasokkum — Thu, 22 Sep 2016 13:53:32 GMT

Thanks..! @sundareshr