<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Dynamic drilldown: Pass the timechart command's time field as an argument in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133890#M7937</link>
    <description>&lt;P&gt;That &lt;EM&gt;should&lt;/EM&gt; work - could you post the xml for the table that's not working?&lt;/P&gt;</description>
    <pubDate>Tue, 25 Nov 2014 22:22:00 GMT</pubDate>
    <dc:creator>martin_mueller</dc:creator>
    <dc:date>2014-11-25T22:22:00Z</dc:date>
    <item>
      <title>Dynamic drilldown: Pass the timechart command's time field as an argument</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133889#M7936</link>
      <description>&lt;P&gt;All,&lt;/P&gt;

&lt;P&gt;I have a search that populates monthly browser usage across all browsers. &lt;CODE&gt;base search | timechart span=1mon count as browserCount by Browser usenull=f&lt;/CODE&gt; We want to display this search in a table so that we can display the actual number. We then want to drilldown into a separate dashboard after we click a value in the row.&lt;/P&gt;

&lt;P&gt;From what I understand from &lt;A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Viz/Dynamicdrilldownindashboardsandforms"&gt;this documentation&lt;/A&gt;, we should just be able to set the time picker in the dashboard drilled into by using &lt;CODE&gt;$earliest$&lt;/CODE&gt; and &lt;CODE&gt;$latest$&lt;/CODE&gt;. So, I would assume this would look something like:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;drilldown target="Drilldown into usage by Browser"&amp;gt;
  &amp;lt;link&amp;gt;
    &amp;lt;![CDATA[
      /app/MyApp/browser_usage_drilldown?form.groupId=*&amp;amp;form.browserId=*&amp;amp;form.timePicker.earliest=$earliest$&amp;amp;form.timePicker.latest=$latest$
    ]]&amp;gt;
  &amp;lt;/link&amp;gt;
&amp;lt;/drilldown&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Instead of using the &lt;EM&gt;row's&lt;/EM&gt; time, however, the drilldown chooses to use the global time of the dashboard. &lt;STRONG&gt;If I switch to a line chart visualization, then this drilldown works as expected. It uses the &lt;EM&gt;row's&lt;/EM&gt; time.&lt;/STRONG&gt;&lt;/P&gt;

&lt;P&gt;Is there a way that we can keep the table view, but still have the &lt;CODE&gt;$earliest$&lt;/CODE&gt; and &lt;CODE&gt;$latest$&lt;/CODE&gt; work as if it were a line chart? It seems weird to me that changing the visualization would affect the time fields, since the documentation seems to suggest otherwise.&lt;/P&gt;

&lt;P&gt;EDIT - Here's the XML. Again, if I change this to a line chart, it works as I'd expect it to. Basically I want it to pass through the month that I clicked on.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    &amp;lt;panel&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;title&amp;gt;Count by Browser&amp;lt;/title&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;base search | timechart span=1mon count as browserCount by Browser usenull=f&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-6mon@mon&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;
        &amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="count"&amp;gt;10&amp;lt;/option&amp;gt;
        &amp;lt;drilldown target="Drilldown into usage by Browser"&amp;gt;
          &amp;lt;link&amp;gt;
            &amp;lt;![CDATA[
              /app/ProductMgmt/browser_usage_drilldown?form.groupId=*&amp;amp;form.browserId=*&amp;amp;form.monthVar.earliest=$earliest$&amp;amp;form.monthVar.latest=$latest$
            ]]&amp;gt;
          &amp;lt;/link&amp;gt;
        &amp;lt;/drilldown&amp;gt;
        &amp;lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&amp;gt;ellipsisNone&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&amp;gt;0&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.axisTitleX.visibility"&amp;gt;visible&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.axisTitleY.visibility"&amp;gt;visible&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.axisTitleY2.visibility"&amp;gt;visible&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.axisX.scale"&amp;gt;linear&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.axisY.scale"&amp;gt;linear&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.axisY2.enabled"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.axisY2.scale"&amp;gt;inherit&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.chart"&amp;gt;line&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.chart.bubbleMaximumSize"&amp;gt;50&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.chart.bubbleMinimumSize"&amp;gt;10&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.chart.bubbleSizeBy"&amp;gt;area&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.chart.nullValueMode"&amp;gt;gaps&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.chart.sliceCollapsingThreshold"&amp;gt;0.01&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.chart.stackMode"&amp;gt;default&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.chart.style"&amp;gt;shiny&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.drilldown"&amp;gt;all&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.layout.splitSeries"&amp;gt;0&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.legend.labelStyle.overflowMode"&amp;gt;ellipsisMiddle&amp;lt;/option&amp;gt;
        &amp;lt;option name="charting.legend.placement"&amp;gt;right&amp;lt;/option&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;cell&amp;lt;/option&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 25 Nov 2014 20:47:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133889#M7936</guid>
      <dc:creator>bruceclarke</dc:creator>
      <dc:date>2014-11-25T20:47:47Z</dc:date>
    </item>
    <item>
      <title>Re: Dynamic drilldown: Pass the timechart command's time field as an argument</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133890#M7937</link>
      <description>&lt;P&gt;That &lt;EM&gt;should&lt;/EM&gt; work - could you post the xml for the table that's not working?&lt;/P&gt;</description>
      <pubDate>Tue, 25 Nov 2014 22:22:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133890#M7937</guid>
      <dc:creator>martin_mueller</dc:creator>
      <dc:date>2014-11-25T22:22:00Z</dc:date>
    </item>
    <item>
      <title>Re: Dynamic drilldown: Pass the timechart command's time field as an argument</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133891#M7938</link>
      <description>&lt;P&gt;I attached the XML for the table. Let me know if you see something wrong. Thanks!&lt;/P&gt;</description>
      <pubDate>Tue, 25 Nov 2014 22:27:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133891#M7938</guid>
      <dc:creator>bruceclarke</dc:creator>
      <dc:date>2014-11-25T22:27:20Z</dc:date>
    </item>
    <item>
      <title>Re: Dynamic drilldown: Pass the timechart command's time field as an argument</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133892#M7939</link>
      <description>&lt;P&gt;Hmm... that should indeed work that way, but apparently doesn't... same over here. Consider filing a case with support to check if that's actually a bug.&lt;/P&gt;

&lt;P&gt;In the meantime, let's cheat our way towards a working drilldown:&lt;/P&gt;

&lt;UL&gt;
&lt;LI&gt;in your search, append this after the &lt;CODE&gt;timechart&lt;/CODE&gt;: &lt;CODE&gt;... | eval _earliest = _time | eval _latest = _time + _span&lt;/CODE&gt;&lt;/LI&gt;
&lt;LI&gt;in your drilldown, use the tokens &lt;CODE&gt;$row._earliest$&lt;/CODE&gt; and &lt;CODE&gt;$row._latest$&lt;/CODE&gt;&lt;/LI&gt;
&lt;/UL&gt;

&lt;P&gt;That'll compute the range of each row invisibly and use that instead of the possibly broken default tokens.&lt;/P&gt;</description>
      <pubDate>Tue, 25 Nov 2014 23:02:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133892#M7939</guid>
      <dc:creator>martin_mueller</dc:creator>
      <dc:date>2014-11-25T23:02:28Z</dc:date>
    </item>
    <item>
      <title>Re: Dynamic drilldown: Pass the timechart command's time field as an argument</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133893#M7940</link>
      <description>&lt;P&gt;That works. I'll create a support issue first thing tomorrow morning.&lt;/P&gt;</description>
      <pubDate>Tue, 25 Nov 2014 23:22:31 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133893#M7940</guid>
      <dc:creator>bruceclarke</dc:creator>
      <dc:date>2014-11-25T23:22:31Z</dc:date>
    </item>
    <item>
      <title>Re: Dynamic drilldown: Pass the timechart command's time field as an argument</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133894#M7941</link>
      <description>&lt;P&gt;in my search, I have append this after the timechart: ... | eval _earliest = _time | eval _latest = _time + _span&lt;/P&gt;

&lt;P&gt;but in the drilldown I use $row._earliest$ and $row._latest$,  I can not get the value&lt;/P&gt;

&lt;P&gt;my search:&lt;BR /&gt;
      ......| timechart limit=0 span=$timespan_tok$ sum(total) by EPC_Log.onErrorMsg|eval _eraliest=_time|eval _latest=_time+_span&lt;/P&gt;

&lt;P&gt;my drilldown :&lt;BR /&gt;
      ......onErrorMsg="$click.name2$"  earliest=$row._time$ latest=$row._latest$   &lt;/P&gt;

&lt;P&gt;when i click the query like this:&lt;BR /&gt;
     ......onErrorMsg="Script"  earliest=1447167600.000 latest=$row._latest$&lt;/P&gt;

&lt;P&gt;So  you can see, I can get $row._time$  but i can not get the $row._latest$  value&lt;/P&gt;

&lt;P&gt;Can you help me ?&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 07:51:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Dynamic-drilldown-Pass-the-timechart-command-s-time-field-as-an/m-p/133894#M7941</guid>
      <dc:creator>aarzhang</dc:creator>
      <dc:date>2020-09-29T07:51:45Z</dc:date>
    </item>
  </channel>
</rss>

