topic Re: Drilldown bug? in Dashboards & Visualizations

Drilldown bug?

shayhibah — Thu, 04 Oct 2018 06:21:51 GMT

Hi,

In my dashboards I use custom drilldown:

<drilldown>
    <set token="clicked_earliest_date">$earliest$</set>
    <eval token="clicked_latest_date">$clicked_earliest_date$+86400</eval>
    <link target="_self">search?q=my_query
            | eval Time=_time
            | convert timeformat="%Y-%m-%d" ctime(Time)
            &amp;earliest=$clicked_earliest_date$&amp;latest=$clicked_latest_date$</link>
</drilldown>

This drilldown used to work but I noticed that there are times it does not work.
1. if I use convert timeformat="%Y-%m-%d" ctime(Time), when drilling down I get an empty search window but I can notice that the URL of this page contains the query.
2. If I remove convert timeformat="%Y-%m-%d" ctime(Time), I get non-empty search window but I also see that time range is different than the time of the clicked event.

I must say again that this drill down sometimes works and sometimes doesn't.

Someone is familiar with this issue?

Re: Drilldown bug?

493669 — Thu, 04 Oct 2018 06:40:18 GMT

try wrapping code in CDATA-
have a look at recent post-
https://answers.splunk.com/answers/690132/in-a-dashboard-why-cant-i-configure-a-drill-down-w-1.html#answer-689302
or simply relace % by %25 for url encoding-

<drilldown>
          <link target="_self">search?q=index=_internal | eval Time=_time| convert timeformat="%25Y-%25m-%25d" ctime(Time)&amp;earliest=-15m&amp;latest=now</link>
        </drilldown>

Re: Drilldown bug?

shayhibah — Thu, 04 Oct 2018 06:50:25 GMT

@493669

Unfortunately it does not work. same problem.

Re: Drilldown bug?

493669 — Thu, 04 Oct 2018 07:04:14 GMT

@shayhibah ,
simply relace % by %25 for url encoding-

 <drilldown>
           <link target="_self">search?q=index=_internal | eval Time=_time| convert timeformat="%25Y-%25m-%25d" ctime(Time)&amp;earliest=-15m&amp;latest=now</link>
         </drilldown>

Re: Drilldown bug?

shayhibah — Thu, 04 Oct 2018 07:23:40 GMT

@493669

Thanks for your reply.
Your proposal semi-helped - it now shows the search window but the time range is still wrong and therefore I don't get results.
The time range is based on the tokens I defined ans for some reason is does not related to them.

Re: Drilldown bug?

493669 — Thu, 04 Oct 2018 07:55:56 GMT

i tried one sample example and it is working ..

<form>
  <label>drilldown_690132</label>
  <fieldset submitButton="false">
    <input type="time" token="timec">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | head 10 | stats count by source</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <link target="_self">search?q=index=_internal | eval Time=_time| convert timeformat="%25Y-%25m-%25d" ctime(Time)&amp;earliest=$timec.earliest$&amp;latest=$timec.latest$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>