topic Re: How to pass a hardcode time range through drilldown link to override default shared time picker of the dashboard? in Splunk Search

How to pass a hardcode time range through drilldown link to override default shared time picker of the dashboard?

wangkevin1029 — Mon, 27 Dec 2021 18:52:50 GMT

Hi, Splunkers，

I have a dashboard with multiple panels, which all use shared time picker from token field2.

when I used the following drilldown link to send token Gucid_token, time range is used dashboard's default time range.

</drilldown>

but when I click drilldown link, I prefer to use a different hardcode time range, like "Last 7 days", instead of original default time range of my dashboard.

so, I added form.field2=Last 7 days in my drilldown link following the 1st token form.Gucid_token=$click.value2 as below.

but unfortunately, it doesn't work.

</drilldown>

anyone knows how to pass the hardcode time range through this drilldown link?

thanks in advance.

Kevin

Re: How to pass a hardcode time range through drilldown link to override default shared time picker of the dashboard?

richgalloway — Tue, 28 Dec 2021 01:34:53 GMT

It depends on what the drilldown search is expecting to receive in field2. Perhaps this will work.

<drilldown> <link target="_blank">/app/appname/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token=$click.value2$&form.field2=-7d</link> </drilldown>

Re: How to pass a hardcode time range through drilldown link to override default shared time picker of the dashboard?

wangkevin1029 — Tue, 28 Dec 2021 01:45:46 GMT

I tried -7d@h, it doesn't work.

I noticed in input type=time....

not sure if it means for any last 24 hrs， 7 days， 30days，latest field also need to be specified?

Kevin

Re: How to pass a hardcode time range through drilldown link to override default shared time picker of the dashboard?

richgalloway — Tue, 28 Dec 2021 13:19:00 GMT

I think we need to see the definition of the drilldown search to know what parameters to pass to it.

means the last 7 days until now.

Re: How to pass a hardcode time range through drilldown link to override default shared time picker of the dashboard?

wangkevin1029 — Tue, 28 Dec 2021 14:13:32 GMT

<drilldown>
  <link target="_blank">/app/appname/guciduuidsid_search_applied_rules_with_ors_log_kvp?form.Gucid_token=$click.value2$&amp;form.field2=-7d</link>
</drilldown>

the key/value patter following the dashboard link is
?form.Gucid_token=$click.value2$&form.field2=-7d

not sure how to add the following two <a>xxx</a> to token fields...

Re: How to pass a hardcode time range through drilldown link to override default shared time picker of the dashboard?

richgalloway — Tue, 28 Dec 2021 15:14:52 GMT

Yes, we've seen how the drilldown is invoked, but not how the target is defined. The KO at guciduuidsid_search_applied_rules_with_ors_log_kvp must be expecting certain fields to be provided. The values of those fields likely are expected to be in a certain format. Once we know that information then we can figure out how to get data from one place to the other.