topic Re: Chart Drill Down changes Date time range in Splunk Search

Chart Drill Down changes Date time range

shayhibah — Tue, 29 Sep 2020 21:25:08 GMT

I have a dashboard with a chart inside it.

The query of the chart is:

base_search | eval _time = time| bucket _time span=24h | chart count over _time by app_risk| fields _time,Critical,High,Medium,Low

The drill down settings are: On Click=Link to Search & Auto.

When clicking on "High" category on specific date, I would like to see the events related to this combination of risk and date.

For some reason, I have no results after drilling down.

For example: I click on events from Sep 15 - I expect the rime range to be Sep 15 00:00:00,000 to Sep 15 23:59:59,999 but (!) the time range is Sep 15 00:00:00,000 to Sep 15 00:00:00,001

Can someone tell me why the results are not related to the specific column date?

Re: Chart Drill Down changes Date time range

HiroshiSatoh — Tue, 02 Oct 2018 09:57:56 GMT

The time range is set from _time of the result by default.
ex.
_time="9/16/18 3:00:00.000"

It is necessary to set the start and end time of each line in the search sentence and give it to the search sentence of the drill down etc.

ex.

  <link>
    <![CDATA[search?q=search index=XXX earliest="$row.earlest_time$" latest="$row.latest_time$" ]]>
  </link>

Re: Chart Drill Down changes Date time range

shayhibah — Tue, 02 Oct 2018 10:46:28 GMT

@HiroshiSatoh

Thanks for your response.
Unfortunately, it still gives me the same results - 9/16/18 3:00:00.000 AM to 9/16/18 3:00:00.001 AM.

Maybe the bucket in the query affect the results?

Re: Chart Drill Down changes Date time range

HiroshiSatoh — Tue, 02 Oct 2018 11:16:49 GMT

Did you make the following edits to the main search?

base_search | eval _time = time| bucket _time span=24h | chart count over _time by app_risk| fields _time,Critical,High,Medium,Low
| eval earlest_time=_time,latest_time=relative_time(_time,"+24h@h")
| fieldformat earlest_time=strftime(earlest_time,"%m/%d/%Y:%H:%M:%S") 
| fieldformat latest_time=strftime(latest_time,"%m/%d/%Y:%H:%M:%S")

Re: Chart Drill Down changes Date time range

shayhibah — Tue, 02 Oct 2018 11:42:05 GMT

Yes I did but it still gives me wrong date time range

Re: Chart Drill Down changes Date time range

HiroshiSatoh — Tue, 02 Oct 2018 12:29:01 GMT

Please check the search sentence generated from "Search job inspector". If start and end are correctly embedded, you should be able to search.