topic Re: View events changes timeframe in Splunk Search

View events changes timeframe

shayhibah — Sun, 14 Oct 2018 09:56:55 GMT

I have dashboards with drill down option.
The drill down query contains custom earliest and latest tokens since there was an issue with the time frame.

<link>....|rename "0" as "High" "1" as "Critical" | table _time,"Critical","High"&amp;earliest=$clicked_earliest_date$&amp;latest=$clicked_latest_date$</link>

After drilling down, the time frame is correct (based on the clicked event time value):
** 158 events (9/14/18 12:00:00.000 AM to 9/15/18 12:00:00.000 AM) **

But, when click on the results and choose "view events", the time frame is changed to its old value (which was wrong - 1 ms instead of 2 days).
0 events (9/14/18 12:00:00.000 AM to 9/14/18 12:00:00.001 AM)

How can I fix it?

Re: View events changes timeframe

shayhibah — Mon, 15 Oct 2018 05:19:14 GMT

Any expert?

Re: View events changes timeframe

Vijeta — Tue, 29 Sep 2020 21:37:21 GMT

Try form.earliest =$clicked_earliest_date$&form.latest=$clicked_latest_date$ in your link tag

Re: View events changes timeframe

shayhibah — Tue, 16 Oct 2018 05:16:07 GMT

hi @Vijeta

Unfortunately it does not work.
After drill down the first time, I clicked on the cell in the table and before clicking on view events, I noticed that in this small picker, the timeframe is wrong and not the same as the search bar.

Re: View events changes timeframe

harsmarvania57 — Tue, 16 Oct 2018 09:41:12 GMT

Which is your splunk version and it will be good if you post your Dashboard XML code (Mask any sensitive data) ?

For me it is working fine in Splunk 7.1.2with below test Dashboard XML

<form>
  <label>dashboard test 1</label>
  <row>
    <panel>
      <input type="time" token="time_tok" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </default>
      </input>
      <table>
        <search>
          <query>index=_internal | head 10 | stats count by host</query>
          <earliest>$time_tok.earliest$</earliest>
          <latest>$time_tok.latest$</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">cell</option>
        <drilldown>
          <link target="_blank">search?q=index=_internal host=$row.host$ bytes=* | table bytes&amp;earliest=$time_tok.earliest$&amp;latest=$time_tok.latest$</link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>