<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: convert timeformat not responding in drilldown link search in simple xml in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/convert-timeformat-not-responding-in-drilldown-link-search-in/m-p/245549#M15293</link>
    <description>&lt;P&gt;Thanks lot. It worked perfectly.&lt;/P&gt;</description>
    <pubDate>Tue, 25 Oct 2016 06:50:59 GMT</pubDate>
    <dc:creator>ssujin</dc:creator>
    <dc:date>2016-10-25T06:50:59Z</dc:date>
    <item>
      <title>convert timeformat not responding in drilldown link search in simple xml</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/convert-timeformat-not-responding-in-drilldown-link-search-in/m-p/245546#M15290</link>
      <description>&lt;P&gt;convert timeformat not responding with drilldown link tag, as a result drilldown search keep on showing loading. Sample simple xml below&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;row&amp;gt;
    &amp;lt;panel name="Job Statistics"&amp;gt;
        &amp;lt;table&amp;gt;
            &amp;lt;title&amp;gt;Job Statistics&amp;lt;/title&amp;gt;
            &amp;lt;search&amp;gt;
                &amp;lt;query&amp;gt;index=$index$ host=$host$ eventtype=et_job_timing | eval Time=_time | convert timeformat="%d-%m-%Y:%H:%M:%S" ctime(Time)| table Time, THROUGHPUT | chart values(THROUGHPUT) by Time&amp;lt;/query&amp;gt;
            &amp;lt;/search&amp;gt;
            &amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;
            &amp;lt;drilldown&amp;gt;
                &amp;lt;link&amp;gt;search?q=search index=$index$ host=$host$ eventtype=et_job_timing| eval Time=_time | convert timeformat="%d-%m-%Y:%H:%M:%S" ctime(Time)| table Time, THROUGHPUT | where Time = "$click.value$"&amp;lt;/link&amp;gt;
            &amp;lt;/drilldown&amp;gt;
        &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
&amp;lt;/row&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;from above simple xml below mentioned search not responding.&lt;/P&gt;

&lt;P&gt;&lt;EM&gt;search?q=search index=$index$ host=$host$ eventtype=et_job_timing| eval Time=_time | convert timeformat="%d-%m-%Y:%H:%M:%S" ctime(Time)| table Time, THROUGHPUT | where Time = "$click.value$"&lt;/EM&gt;&lt;/P&gt;

&lt;P&gt;kindly guide me on this error.&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 11:22:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/convert-timeformat-not-responding-in-drilldown-link-search-in/m-p/245546#M15290</guid>
      <dc:creator>ssujin</dc:creator>
      <dc:date>2020-09-29T11:22:34Z</dc:date>
    </item>
    <item>
      <title>Re: convert timeformat not responding in drilldown link search in simple xml</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/convert-timeformat-not-responding-in-drilldown-link-search-in/m-p/245547#M15291</link>
      <description>&lt;P&gt;convert command It looks like no good.&lt;BR /&gt;
Workaround:&lt;BR /&gt;
Macro the convert.&lt;/P&gt;

&lt;P&gt;my_macro:convert timeformat="%d-%m-%Y:%H:%M:%S" ctime(Time)&lt;BR /&gt;
↓&lt;BR /&gt;
search?q=search index=$index$ host=$host$ eventtype=et_job_timing| eval Time=_time |‘my_macro‘| table Time, THROUGHPUT | where Time = "$click.value$"&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 11:22:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/convert-timeformat-not-responding-in-drilldown-link-search-in/m-p/245547#M15291</guid>
      <dc:creator>HiroshiSatoh</dc:creator>
      <dc:date>2020-09-29T11:22:36Z</dc:date>
    </item>
    <item>
      <title>Re: convert timeformat not responding in drilldown link search in simple xml</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/convert-timeformat-not-responding-in-drilldown-link-search-in/m-p/245548#M15292</link>
      <description>&lt;P&gt;What are you trying to do? You cannot do an &lt;CODE&gt;eval&lt;/CODE&gt; in  &lt;CODE&gt;link&lt;/CODE&gt;. Link requires a valid URL that will be launched. You can pass token values as querystring, but you will need to format them earlier.  In short, what you have here will not work, but if you can explain what it is that you are trying to accomplish in your dashboard, we can help.&lt;/P&gt;</description>
      <pubDate>Thu, 13 Oct 2016 11:40:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/convert-timeformat-not-responding-in-drilldown-link-search-in/m-p/245548#M15292</guid>
      <dc:creator>sundareshr</dc:creator>
      <dc:date>2016-10-13T11:40:55Z</dc:date>
    </item>
    <item>
      <title>Re: convert timeformat not responding in drilldown link search in simple xml</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/convert-timeformat-not-responding-in-drilldown-link-search-in/m-p/245549#M15293</link>
      <description>&lt;P&gt;Thanks lot. It worked perfectly.&lt;/P&gt;</description>
      <pubDate>Tue, 25 Oct 2016 06:50:59 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/convert-timeformat-not-responding-in-drilldown-link-search-in/m-p/245549#M15293</guid>
      <dc:creator>ssujin</dc:creator>
      <dc:date>2016-10-25T06:50:59Z</dc:date>
    </item>
  </channel>
</rss>

